Firebase Cloud Firestore Security Rules 2

Apply these rules to Security Rules language v2 for native-mode Firestore Core operations. They cover mobile/web client and Firebase ID-token access, plus the boundaries where server credentials use IAM instead. Firestore with MongoDB compatibility is outside this scope.

Rulesets and database selection

• Start each ruleset with rules_version = '2';, use service cloud.firestore, and place document matches under /databases/{database}/documents.
• Select the intended Firebase project and database explicitly for deployment. Each named database needs its own deployed rules; the {database} wildcard does not deploy one ruleset to every database.
• Keep production rules closed except for the paths and operations the application needs. Remove test-mode grants and temporary time-based open-access rules before exposing data.
• Keep the rule file and its database mapping together in firebase.json. Review the effective deployment target instead of relying on a developer's current CLI project alias.
• Publish the tested ruleset as the database's active release. Creating or uploading a ruleset without activating the corresponding release does not change enforcement.
• Account for propagation during permission changes: new queries and listeners can take up to a minute to see a deployment, and active listeners can take up to ten minutes. Do not promise immediate revocation from a rules deployment.

Authentication and trusted claims

• Guard protected operations with request.auth != null and bind the operation to request.auth.uid; a caller-supplied document field or