firestore.rules

service cloud.firestore {
  match /databases/{database}/documents {
    match /users/{userId} {
      allow read;
      allow write: if exists(request.resource.data.room);
    }
    match /rooms/{roomId} {
      allow read, write;
    }
  }
}

test.js

const firebase = require("@firebase/testing");
const fs = require("fs");

const projectId = "firestore-emulator-example";
const coverageUrl = `http://localhost:8080/emulator/v1/projects/${projectId}:ruleCoverage.html`;

const rules = fs.readFileSync("firestore.rules", "utf8");

function authedApp(auth) {
  return firebase
    .initializeTestApp({ projectId, auth })
    .firestore();
}

beforeEach(async () => {
  await firebase.clearFirestoreData({ projectId });
});

before(async () => {
  await firebase.loadFirestoreRules({ projectId, rules });
});

after(async () => {
  await Promise.all(firebase.apps().map(app => app.delete()));
  console.log(`View rule coverage information at ${coverageUrl}\n`);
});

it("doc refs work", async () => {
  const db = authedApp(null);
  const profile = db.collection("users").doc("alice");
  const chatroom = db.collection("rooms").doc("alice's hangout");

  const payload = { birthday: "January 1", room: chatroom };

  await firebase.assertFails(profile.set(payload));

  await chatroom.set({});
  await firebase.assertSucceeds(profile.set(payload));
});