How to set security rules in firestore.rules file?

Question

I have two collections:

• private_books

• public_books

I want that public_books(all its sub-categories) only be accessed by admin (node.js) and private_books(all its sub-categories) for authorized people(logged in with accounts) and admin both.

How can I achieve this? I am new to Firebase.

Currently Firestore is in test mode anyone can access these collections.

Edit: as there is no need to add rules for firebase admin. I want security rules for public_books collection so that no-one can edit or change this collection and another different security rule for private_books collection so that only authorized users can view this collection.

Answer 1

You don't have to write any rules for access by server side code using the Firebase Admin SDK. It will always have full access to everything no matter what you write in the rules.

The documentation gives you the instructions to require authentication to access documents in a collection. Copied from that link:

One of the most common security rule patterns is controlling access based on the user's authentication state. For example, your app may want to allow only signed-in users to write data:

service cloud.firestore {
  match /databases/{database}/documents {
    // Allow the user to access documents in the "cities" collection
    // only if they are authenticated.
    match /cities/{city} {
      allow read, write: if request.auth.uid != null;
    }
  }
}

Just replace "cities" with the name of your collection.