{
  "orgs/$orgId": {
    "fields": { "name": "String", "owner": "String!" },
    "tier": "durable",
    "rules": {
      "read": "@user.id != null && (get(/orgs/$orgId).owner == @user.id || get(/orgs/$orgId/members/@user.id).role != null)",
      "create": "@user.id != null && @newData.owner == @user.id",
      "update": "@user.id != null && get(/orgs/$orgId).owner == @user.id && @newData.owner == @data.owner",
      "delete": "@user.id != null && get(/orgs/$orgId).owner == @user.id"
    }
  },
  "orgs/$orgId/members/$memberId": {
    "fields": { "org": "String", "role": "String", "identity": "String" },
    "tier": "durable",
    "rules": {
      "read": "@user.id != null && (get(/orgs/$orgId).owner == @user.id || get(/orgs/$orgId/members/@user.id).role != null)",
      "create": "@user.id != null && (get(/orgs/$orgId).owner == @user.id || get(/orgs/$orgId/members/@user.id).role == \"admin\")",
      "update": "@user.id != null && get(/orgs/$orgId/members/@user.id).role == \"admin\"",
      "delete": "@user.id != null && get(/orgs/$orgId).owner == @user.id"
    },
    "invariants": [
      { "type": "tenantTag", "name": "member_org", "field": "org", "pathVariable": "$orgId" }
    ]
  },
  "orgs/$orgId/docs/$docId": {
    "fields": { "org": "String", "title": "String", "body": "String", "authorRef": "String" },
    "tier": "durable",
    "search": { "fields": ["title", "body"] },
    "rules": {
      "read": "@user.id != null && get(/orgs/$orgId/members/@user.id).role != null",
      "create": "@user.id != null && get(/orgs/$orgId/members/@user.id).role != null",
      "update": "@user.id != null && get(/orgs/$orgId/members/@user.id).role != null",
      "delete": "@user.id != null && get(/orgs/$orgId/members/@user.id).role == \"admin\""
    },
    "invariants": [
      { "type": "tenantTag", "name": "doc_org", "field": "org", "pathVariable": "$orgId" },
      { "type": "tenantEdge", "name": "author_same_org", "field": "org", "referenceField": "authorRef", "targetScope": "orgs/$orgId/members/$memberId", "targetField": "org", "targetPathVariable": "$memberId" }
    ]
  }
}