firestore.rules

rules_version = '2';
service cloud.firestore {

  match /databases/{database}/documents {
    function signedIn() {
      return request != null && request.auth != null && request.auth.uid != null;
    }

    function isUser(userId) {
      return request.auth.uid == userId;
    }

    function hasCompany(companyId) {
      return companyId == get(/databases/$(database)/documents/users/$(request.auth.uid)).data.companyId;
    }

    match /decisions/{decisionId} {
      allow read: if signedIn() && hasCompany(resource.data.companyId);
      allow create: if signedIn()
      allow update, delete: if signedIn() && hasCompany(resource.data.companyId);

      function decisionData() {
        return get(/databases/$(database)/documents/decisions/$(decisionId)).data
      }

      match /feedback/{feedbackId} {
        allow read: if signedIn() && hasCompany(decisionData().companyId);
        allow create: if signedIn()
        allow update, delete: if signedIn() && hasCompany(decisionData().companyId);
      }
    }

    match /users/{userId} {
      allow read: if hasCompany(resource.data.companyId);
      allow write: if isUser(userId);
    }
  }
}