firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /users/{userId} {
      allow read, write: if request.auth.uid == userId;
    }

    function isMember(workspaceId) {
      return exists(/databases/$(database)/documents/workspaces/$(workspaceId)/members/$(request.auth.uid));
    }

    match /workspaces/{workspaceId} {
      allow delete: if request.auth.uid == resource.data.ownerId;
      allow read, update: if isMember(workspaceId);
      allow list;
      match /members/{memberId} {
        allow write: if request.auth.uid == memberId && (request.resource.data.role == "owner" && request.auth.uid == get(/databases/$(database)/documents/workspaces/$(workspaceId)).data.ownerId) || (request.resource.data.role in ["viewer", "editor"]);
      }
      match /tables/{tableId} {
        allow read, update: if isMember(workspaceId);
        match /columns/{columnId} {
          allow read, update: if isMember(workspaceId);
        }
        match /rows/{rowId} {
          allow read, update: if isMember(workspaceId);
        }
        match /cells/{rowId} {
          allow read, update: if isMember(workspaceId);
        }
      }
    }
  }
}