firestore.rules

rules_version = '2';

service cloud.firestore {
  match /databases/{database}/documents {

    function isAuthenticated() {
      return request.auth.uid != null
    }

    function isAdmin() {
      return isAuthenticated() &&
        'role' in request.auth.token &&
        request.auth.token.role == 'admin'
    }

    function isOwner(userId) {
      return isAuthenticated() &&
        userId == request.auth.uid
    }

    // Equivalent, more specific
    // match /inventories/{userId}/items/{itemId} {
    match /inventories/{userId}/{doc=**} {
      allow read, write: if isOwner(userId);
    }

    // Equivalent, more specific
    // match /lists/{userId}/items/{itemId}
    match /lists/{userId}/{doc=**} {
      allow read, write: if isOwner(userId);
    }

    match /invites/{inviteId} {
      allow read: if true;
      allow create: if isAdmin();
      allow delete: if isAuthenticated();
    }
  }
}