firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /users/{user_id} {
      allow read, create: if request.auth != null;
      allow update: if request.auth.uid == user_id;
    }
    match /projects/{project_id} {
      allow read, create, update: if request.auth != null;
      allow delete: if request.auth.uid == resource.data.createdBy.id;
    }
  }
}

// users collection
// - any authenticated user can read & create
// - only users who "own/created" a document can update it (user id's match)

// projects collection
// - any authenticated user can read, create & update a document
// - only users who "own/created" a document can delete it