firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {

    match /user-profile/{userId} {
      allow read;
      allow create: if request.auth.uid == userId;
      allow update: if request.auth.uid == userId;
      allow delete: if false;
    }

    match /album/{document} {
      allow read;
      allow create: if request.auth.uid == request.resource.data.createdBy;
      allow update: if request.auth.uid == request.resource.data.createdBy;
      allow delete: if request.auth.uid == request.resource.data.createdBy && request.auth.uid == request.resource.data.albumType == "CUSTOM";
    }

    match /album-image/{document} {
      allow read;
      allow create: if request.auth.uid == request.resource.data.createdBy;
      allow update: if request.auth.uid == request.resource.data.createdBy;
      allow delete: if request.auth.uid == request.resource.data.createdBy;
    }

    // forbid everything else
    match /{document=**} {
      allow read, write: if false;
    }
  }
}