To allow the app to function correctly, add the following security rules to your Firestore project in the rules tab:
- Restaurants: Anyone can read a restaurant. Only authenticated users can create or update restaurants. Deletions are prohibited.
- Ratings: Anyone can read a rating. Authenticated users can create ratings. Only the user who created the rating can delete it. Ratings cannot be updated.
match /databases/{database}/documents {
// Anyone can read a restaurant, only authorized
// users can create or update. Deletes are not allowed.
match /restaurants/{restaurantId} {
allow read: if true;
allow create, update: if request.auth.uid != null;
}
// Anyone can read a rating. Only the user who made the rating
// can delete it. Ratings can never be updated.
match /restaurants/{restaurantId}/ratings/{ratingId} {
allow read: if true;
allow create: if request.auth.uid != null;
allow delete: if request.resource.data.userId == request.auth.uid;
allow update: if false;
}
}
}