Cloud Firestore security rules - single protected field in a document

Question

I'd like to have a read-only property called suspendedProfile in a user document with all the other properties with read/write access for currently logged in user. Is there a way to do it with a simple security rule?

I thought about 2 solutions:

1. disallow writes that modify the property like allow write: if request.resource.data.suspendedProfile == null;
2. a /secure collection with allow read; inside the user document

I think the first option is better all the user-related properties are in a single docment, but I'd love to hear your thoughts. Is there any other simpler way to achieve this?

Answer 1

I think I managed to find a solution for my own answer using Firebase documentation.

// A user can update a product reviews, but they can't change
// the headline.
// Also, they should only be able up update their own product review,
// and they still have to list themselves as an author
allow update: if request.resource.data.headline == resource.data.headline
                    && resource.data.authorID == request.auth.userID
                    && request.resource.data.authorID == request.auth.userID;

So in my case, I will just allow update: if request.resource.data.suspendedProfile == resource.data.suspendedProfile