firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {

    function isSignedIn() {
      return request.auth != null && request.auth.uid != null;
    }

    function recipeIsValid(resourceId) {
      let hasId = 'id' in request.resource.data;
      let hasName = 'name' in request.resource.data && request.resource.data.name.size() > 0;
      let idMatchesResourceId = request.resource.data.id == resourceId;
      return hasId && idMatchesResourceId && hasName;
    }

    match /recipeDetails/{recipeId} {
      allow read, delete: if isSignedIn();
      allow create, update: if 
      	isSignedIn() && 
      	recipeIsValid(recipeId);
    }

    match /aggregates/recipePreviews {
    	// allow only read because document is updated via a background function
      allow read: if isSignedIn();
    }

    match /aggregates/keywords {
    	// allow only read because document is updated via a background function
      allow read: if isSignedIn();
    }
  }
}