title: Firestore Security Rules for this scenario
body: <p>I am new to the Firestore security rules and I wanted to make sure that the rules I wrote are secure for my case.</p>
  
  <p>My database structure is like the following:</p>
  
  <blockquote>
    <p>users / userId / employees / employeeId / files / fileId</p>
  </blockquote>
  
  <p>The reason I don't denormalize it and create a separate collection for users, employees and files is because this application does not require any sort of cross collection query, there is no place in the application where all employees or their files need to be listed. Which brings me to the rules.</p>
  
  <p>Only the owner of the employee or file collections should be able to access it. Everything inside employees or files can be changed. For the users collection, only creation should be allowed since new users should be able to be created when signing in but no user should be able to edit or delete any other existing user.
  Apart from all of the above, there isn't anything else, there are no roles for this app.</p>
  
  <p>My rules are the following:</p>
  
  <pre><code>  service cloud.firestore {
  
    match /databases/{database}/documents {
  
      //can read and create if matching userId 
      //CREATE: NO USER CAN DELETE ACCOUNTS
      match /users/{userId} {
        allow read, create: if request.auth.uid == userId;
  
        //can read and write if matching userId 
        match /employees/{employeeId} {
          allow read, write, update: if request.auth.uid == userId;
  
              //can read and write if matching userId 
              match /files/{fileId} {
                allow read, write: if request.auth.uid == userId; 
              }
  
          }
  
      }
  
    }
  
  }
  </code></pre>
  
  <p>My question would be if my rules are secure? This seems awfully simplistic and I am just not sure if it is enough for my case.</p>
  
  <p>Thanks in advance!</p>