firestore and storage rules

firestore.rules

@@ -0,0 +1,26 @@
+rules_version = '2';
+service cloud.firestore {
+  match /databases/{database}/documents {
+    match /messages/{messageId} {
+
+      // anyone can read messages
+      allow read: if true;
+
+      // anyone can create a message
+      // text must exist and be under 240 characters
+      allow create: if
+        request.resource.data.text is string &&
+        request.resource.data.text.size() <= 240;
+
+      // the only update allowed is an echo 
+      // echoCount and lastEchoAt fields can be changed
+      // this prevents anyone from editing the text of someone else's message
+      allow update: if
+        request.resource.data.diff(resource.data)
+          .affectedKeys().hasOnly(['echoCount', 'lastEchoAt']);
+
+      // nobody can delete messages through the client
+      allow delete: if false;
+    }
+  }
+}