Some sample firebase rules.

firestore.rules

rules_version = '2';

function isAuthenticated(request){
  return request.auth != null && request.auth.uid != null
}

function isDocUidSameAsUserUid(request){
  return request.auth.uid == request.resource.data.uid
}

function userOwnsDocument(request, document){
  return request.auth.uid == document.data.uid
}

service cloud.firestore {
  match /databases/{database}/documents {

    match /goals/{document} {
      allow list;
      allow create, delete: if isAuthenticated(request) && isDocUidSameAsUserUid(request);
      allow read, write: if isAuthenticated(request) && userOwnsDocument(request, document) && isDocUidSameAsUserUid(request);
    }

    match /users/{userId}/privategoals/{document} {
      allow create: if isAuthenticated(request) && isDocUidSameAsUserUid(request)
      allow read, write: if isAuthenticated(request) && isDocUidSameAsUserUid(request) && userOwnsDocument(request, document)
    }
  }

}