Security Rules

This is a drop-in example of Firebase Security Rules designed for a typical chat application. You can copy and paste it in your project's Firebase console, Firestore service, Rules tab.

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    // Function available for all collections
    // Checks that request is coming from an authenticated user
    function isSignedIn() {
      return request.auth != null;
    }

    // Rules for the users collection
    match /users/{userId} {
      // Validates user's object format
      // Remove this if you don't plan to provide first or last names
      function isUserCorrect() {
        return isSignedIn() && request.resource.data.firstName is string && request.resource.data.lastName is string;
      }

      // Checks that the document was created by currently logged in user
      function isSelf() {
        return request.auth.uid == userId;
      }

      // Rules set for the users collection
      allow create: if isUserCorrect();
      allow delete: if isSelf();
      allow read: if isSignedIn();
      allow update: if isUserCorrect() && isSelf();
    }

    // Rules for the rooms collection
    match /rooms/{roomId} {
      // Checks that currently logged in user exists in users collection
      function userExists() {
        return isSignedIn() && exists(/databases/$(database)/documents/users/$(request.auth.uid));
      }

      // Checks that currently logged in user is in the room
      function isUserInRoom() {
        return isSignedIn() && request.auth.uid in resource.data.userIds;
      }

      // Validates room's object format
      function isRoomCorrect() {
        return request.resource.data.type is string && request.resource.data.userIds is list;
      }

      // Rules set for the rooms collection
      allow create: if userExists() && isRoomCorrect();
      allow delete, read, update: if isUserInRoom();

      // Rules for the messages collection
      match /messages/{messageId} {
        // Checks that currently logged in user is in the room
        function isUserInRoomUsingGet() {
          return isSignedIn() && request.auth.uid in get(/databases/$(database)/documents/rooms/$(roomId)).data.userIds;
        }

        // Validates message's object format
        function isMessageCorrect() {
          return request.resource.data.authorId is string && request.resource.data.createdAt is timestamp;
        }

        // Checks that message's author is currently logged in user
        function isMyMessage() {
          return request.auth.uid == resource.data.authorId;
        }

        // Rules set for the messages collection
        allow create: if isSignedIn() && isMessageCorrect();
        allow delete, read: if isUserInRoomUsingGet();
        allow update: if isUserInRoomUsingGet() && isMyMessage();
      }
    }
  }
}

To learn more head over to the Firebase Security Rules website.