firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    function isOwner(uid) {
      return request.auth.uid == uid;
    }

    function getField(key) {
      return request.resource.data[key];
    }

    function checkUnchangedField(key) {
      return getField(key) == resource.data[key];
    }

    function verifyFields(required, optional) {
      let allowed = required.concat(optional);
      return request.resource.data.keys().hasAll(required) &&
             request.resource.data.keys().hasOnly(allowed);
    }

    match /{document=**} {
      allow read: if false;
      allow write: if false;
    }

    match /users/{docId} {
      function checkEmail() {
        let email = getField('email');
        return email is string &&
               email.size() > 3 &&
               email.size() < 254 &&
               (request.method != 'update' || checkUnchangedField('email')); // If updating doc, email cannot change
      }

      function checkName() {
        let name = getField('name');
        return name is string &&
               name.size() < 100;
      }

      function checkLikedBooks() {
        let likedBooks = getField('likedBooks');
        return likedBooks is list &&
               (request.method != 'create' || likedBooks.size() == 0); // If creating doc, no liked books allowed
      }

      function checkDisplay() {
        let display = getField('display');
        return display.darkMode is bool &&
               display.direction is string &&
               display.spacing is string &&
               display.theme.primary.color is string &&
               display.theme.primary.shade is string &&
               display.theme.secondary.color is string &&
               display.theme.secondary.shade is string;
      }

      allow read: if isOwner(docId);
      allow update, create: if isOwner(docId) &&
                               verifyFields(['email', 'name', 'picture', 'display', 'likedBooks'], []) &&
                               checkEmail() &&
                               checkName() &&
                               getField('picture') is string &&
                               checkLikedBooks() &&
                               checkDisplay();
      allow delete: if isOwner(docId);
    }

    match /books/{docId} {
      allow read;
    }
  }
}