firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    function isOwner(res) {
      return res.data.createdBy == request.auth.uid
    }

    // Public products
    match /products/{productsId} {
      allow read;
      allow write: if false;
    }

    // Private user profiles
    match /users/{userId} {
      allow read;
      allow write: if request.auth.uid == userId;
    }

    // Public user profiles
    match /users_public/{userId} {
      allow read;
      allow write: if false; // only written to by indexUser cloud function
    }

    // Needs
    match /needs/{needId} {
      // Only needs you own can be viewed
      allow create: if isOwner(request.resource);
      allow read, update, delete: if isOwner(resource);
      // Rules apply to all child collections
      match /{allChildren=**} {
        allow read, write: if isOwner(get(/databases/$(database)/documents/needs/$(needId)));
      }
    }
  }
}