Firestore security rules to share data between users

Question

Imagine I want to create an app that allows users to manage a shopping list. A user should be able to share his shopping list with other users, but users that were not 'invited' should not have access to this data.

If I want to implement this without sharing data, I can protect the user data pretty easily:

service cloud.firestore {
  match /databases/{database}/documents {
    match /users/{userId}/list {
      allow read, update, delete: if request.auth != null && request.auth.uid == userId;
      allow create: if request.auth != null;
    }
  }
}

But how can I make sure that 'invited' users are also able to read and write to these documents?

The data will be stored as follows:

- Collection: Lists
    - Subcollection: Items

The List document will probably need to keep track of which users are allowed to add or remove Items.

How do you plan to declare the 'invited' users? In a list in a doc? As docs in a collection? — Renaud Tarnec
I imagine it would depend on the implementation of the security rules, but I've updated my question. — Titulum

Ahmed Elmasry Ahmed Elmasry · Accepted Answer · 2021-01-19T12:32:48

Declare invited users in a sub collection that looks like this /users/{userId}/list/invited/{userId}

In Firestore rules, you can check if a document with a user id exists in the invited users sub collection.

service cloud.firestore {
  match /databases/{database}/documents {
    match /users/{userId}/list {
      allow read, write: if request.auth != null && exists(/databases/$(database)/documents/users/$(userId)/list/invited/$(request.auth.uid));
    }
  }
}

Firestore security rules to share data between users

1 Answers