simple role management

firestore.rules

@@ -2,8 +2,17 @@ rules_version = '2';
 service cloud.firestore {
   match /databases/{database}/documents {
     match /users/{user} {
-      allow read: if resource.id == request.auth.uid;
-      allow write: if resource.id == request.auth.uid;
+
+    	function isUser(rsc) {
+        return rsc.id == request.auth.uid
+      }
+
+      function isAdmin() {
+        return get(/databases/$(database)/documents/users/$(request.auth.uid)).data.role == 'admin'
+      }
+
+      allow read: if isUser(resource) || isAdmin();
+      allow write: if isUser(resource) || isAdmin();
     }
 
     match /songs/{song} {
@@ -31,3 +40,4 @@ service cloud.firestore {
   }
 }
 
+