firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    function isSignedIn() {
      return request.auth != null;
    }
    function userId() {
      return request.auth.uid;
    }
    function ownsItem() {
      return userId() == existingData().owner.id;
    }
    function accessesField(field) {
      return incomingData().diff(existingData()).affectedKeys().hasOnly([field]);
    }

    // [READ] Data that exists on the Firestore document
    function existingData() {
      return resource.data;
    }
    // [WRITE] Data that is sent to a Firestore document
    function incomingData() {
      return request.resource.data;
    }

    match /tasks/{task} {
      allow read: if isSignedIn();
      allow create: if isSignedIn() && userId() == incomingData().owner.id;
      allow update: if isSignedIn() && ownsItem();
      allow delete: if isSignedIn() && ownsItem();
    }

    match /users/{user} {
      allow read: if true;
      allow write: if false;
    }

    match /{document=**} {
      allow read, write: if false;
    }
  }
}