firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    // user writes are simple, only the owner
    match /users/{userId} {
      allow read, write: if userId == request.auth.uid;

      match /boxes/{box} {
        allow read, write: if userId == request.auth.uid;
      }
    }

    match /boxes/{box} {
      allow read: if resource == null 
        || request.auth.uid in resource.data.owners 
        || resource.data.visibility != 'private';
      allow write: if resource == null 
        || request.auth.uid in resource.data.owners;

      match /recipes/{recipe} {
        allow read: if resource == null 
          || request.auth.uid in resource.data.owners
          || request.auth.uid in get(/databases/$(database)/documents/boxes/$(box)).data.owners
          || get(/databases/$(database)/documents/boxes/$(box)).data.visibility != 'private'
          || resource.data.visibility != 'private';
        allow write: if resource == null 
          || request.auth.uid in get(/databases/$(database)/documents/boxes/$(box)).data.owners 
          || request.auth.uid in resource.data.owners;
      }
    }
  }
}