Firestore Rules

firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
   match /Users/{UserId} {
      // Allow anyone to create an account
      allow create: if true;
      // UserId comes from {UserId} above
      // the UserId will be auto-filled with the UserId
      // of the user trying to access this record
      allow read, update, delete: if isOwner(UserId);
    }
    
    match /Posts/{PostId} {
      allow create: if isLoggedIn();
      allow read: true;
      // resource.data will give you access to the document data
      // so if your document has a field called OwnerId you can access
      // that and check it against the current user
      allow update, delete: if isOwner(resource.data.OwnerId);
    }
    
    match /Comments/{CommentId} {
      allow read, create: if isLoggedIn();
      allow update, delete: if isOwner(resource.data.OwnerId);
    }
    
    // You can create custom functions so that you can re-use logic
    // for rules.
    function isLoggedIn() {
      return request.auth.uid != null;
    }
    function isOwner(uid) {
      return request.auth.uid == uid;
    }
  }
}