firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    // Verifies if the field 'key' is the same before and after the request
    function isUnchanged(key) {
      return (key in request.resource.data)
        && (key in resource.data)
        && (resource.data[key] == request.resource.data[key]);
    }

    // Verifies if the user is authenticated
    function isUserAuthenticated() {
      return request.auth != null;
    }

    // Restaurants collection
    match /restaurants/{restaurantId} {
      // Any authenticated user can read
      allow read: if isUserAuthenticated();

      // Any authenticated user can create
      allow create: if isUserAuthenticated();

      // Any authenticated user can update only if no new fields are added and 'name' is unchanged
      allow update: if isUserAuthenticated()
                    && (request.resource.data.keys() == resource.data.keys())
                    && isUnchanged("name");

      // Deletes are not allowed
      allow delete: if false;

      // Ratings subcollection
      match /ratings/{ratingId} {
        // Any authenticated user can read
        allow read: if isUserAuthenticated();

        // Any authenticated user can create if 'userId' matches their uid
        allow create: if isUserAuthenticated()
                      && request.resource.data.userId == request.auth.uid;

        // Deletes and updates are not allowed
        allow update, delete: if false;
      }
    }
  }
}