firestore.rules

rules_version = '2';

service cloud.firestore {
  match /databases/{database}/documents {
    match /projects/{project} {
      function getProjectResource() {
        return get(/databases/$(database)/documents/projects/$(project));
      }

      function isEmailVerified() {
        return
          request.auth != null &&
          request.auth.token.email_verified;
      }

      function isUserListed(projectResource) {
        return request.auth.token.email in projectResource.data.users;
      }

      function isUserAllowed(projectResource) {
        return
          isEmailVerified() &&
          isUserListed(projectResource);
      }

      allow read: if isUserAllowed(resource);

      match /user_presence/{user} {
        allow read: if isUserAllowed(getProjectResource());
        allow write: if isUserAllowed(getProjectResource()) && user == request.auth.token.email;
      }

      match /{collection}/{docId} {
        allow read: if isUserAllowed(getProjectResource());

        match /{nestedCollection}/{nestedDocId} {
          allow read: if
            isUserAllowed(getProjectResource()) &&
            (collection != "tables" || docId != "uuid-table");
        }
      }
    }
  }
}