firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
  
    match /{document=**} {
      allow read, write: if false;
    }
    
    match /messages/{docId} {
    	allow read: if isSignedIn();
      allow update: if isSignedIn() && request.resource.data.diff(resource.data).affectedKeys().hasOnly(["unread"]);
      allow create: if canCreateMessage();
    }

    function isSignedIn () {
      return request.auth.uid != null;
    }
    
    function canCreateMessage () {
      let isOwner = request.auth.uid == request.resource.data.uid;
      let messageNotTooLarge = request.resource.size() < 10000;
      return isSignedIn() && isOwner && messageNotTooLarge;
    }
  }
}