## Full example

    rules_version = '2';
    service cloud.firestore {

      match /databases/{database}/documents {

        // Returns `true` if the requested post is 'published'
        // or the user authored the post
        function authorOrPublished() {
          return resource.data.published == true || request.auth.uid == resource.data.author;
        }

        match /{path=**}/posts/{post} {

          // Anyone can query published posts
          // Authors can query their unpublished posts
          allow list: if authorOrPublished();

          // Anyone can retrieve a published post
          // Authors can retrieve an unpublished post
          allow get: if authorOrPublished();
        }

        match /forums/{forumid}/posts/{postid} {
          // Only a post's author can write to a post
          allow write: if request.auth.uid == resource.data.author;
        }
      }

      match /databases/{database}/reviews {
        // Assign roles to all users and refine access based on user roles
        match /some_collection/{document} {
          allow read: if get(/databases/$(database)/reviews/users/$(request.auth.uid)).data.role == "Reader"
          allow write: if get(/databases/$(database)/reviews/users/$(request.auth.uid)).data.role == "Writer"
        }
      }
    }