service cloud.firestore {
  match /databases/{database}/documents {

  	function isAdmin() {
      	return get(/databases/$(database)/documents/access/$(request.auth.token.email)).data.permission == "admin";
      }

      match /meetings/{meetingId} {
      function correctUserMeeting() {
            return get(/databases/$(database)/documents/access/$(request.auth.token.email)).data.obj[get(/databases/$(database)/documents/meetings/$(meetingId)).data.groupId] == "leader"
          }
      }
            allow read: if correctUserMeeting() || isAdmin()
      		allow write: if isAdmin() || correctUserMeeting()
      }

    match /access/{userId} {
     function correctEmail() {
        return request.auth.token.email == userId || get(/databases/$(database)/documents/access/$(request.auth.token.email)).data != null;
      }

      allow read: if correctEmail() || isAdmin();
      allow write: if correctEmail() || isAdmin();
    }

    match /groups/{groupsId} {

      function correctEmail2() {
				return get(/databases/$(database)/documents/access/$(request.auth.token.email)).data[groupsId] == "leader"
        || get(/databases/$(database)/documents/access/$(request.auth.token.email)).data.groupsId == "leader";
      }

      allow read: if true
      allow write: if isAdmin()

      match /meetings/{meetingId} {
        allow read: if correctEmail2() || isAdmin();
        allow write: if isAdmin() || correctEmail2();
      }
    }

    match /users/{userId}{
    allow read, write: if isAdmin() || get(/databases/$(database)/documents/access/$(request.auth.token.email)).data != null;
    }
  }
}