Firestore rules objects

Question

I am trying to setup some basic Firestore security rules in my database. I am having some trouble finding the relevant documentation to learn how to do this.

Currently my document is structured like this:

project(document): {
  createdBy(string): [email protected],
  users(object): {
    { [email protected](object): access: write },
    { [email protected](object): access: read }
  }
}

I'd like to setup my rules so that:

• Users must be signed in to read, write or delete anything

• If a user is added to a project with 'read' access they can only read the document.

• If a user is setup with write access they can update and read the document but not update the createdBy field.

• If a user has created the document they can read, update and delete the document.

My security rules are setup like this:

service cloud.firestore {
  match /databases/{database}/documents {
    match /projects/{projectId} {
      allow read: if existingData().users[getUser()token.email].access != null && isSignedInAndVerified()
      allow read, update: if existingData().users[getUser()token.email].access != "write" && isSignedInAndVerified()
      allow update, delete: if sameAsEmail(existingData().createdBy) && isSignedInAndVerified()
    }
    //my functions
    function getUser(){
      return request.auth
    }
    function existingData(){
      return resource.data
    }
    function sameAsEmail(resource){
      return resource == request.auth.token.email
    }
    function isSignedInAndVerified() {
      return request.auth != null && request.auth.token.email_verified;
    }
  }
}

Answer 1

Incorrect use of syntax use: getUser().token.email instead.