How do I write a Firestore security rule so that only someone who is listed as an admin can perform certain actions and everyone else can only read?

The structure is:

/groups/{groupID}

Inside this {groupID} record, it will have the following fields (the last one is a subcollection). The adminUID listed in this collection is the one who should have the extra permissions.

groupID
groupName
adminUID
adminUsername
createDate
creatorUID
creatorUsername
initialGroupCreate
groupMembersSubcollection

For the static fields, the admin should be able to:

• create the {groupID} record with these static fields, cannot modify/delete

The members of the group can only read but not write/delete.

For the subcollection, the admin should be able to:

• create/delete any number of records in the groupMembersSubcollection; cannot modify

The members of the group can only read records in this sub-collection.

Assuming your Firestore collection structure is as follows and your documents inside groupMembersSubcollection saved with document id as group Members user.uid :

Firestore Database
└── groups - (Collection)
└── {groupID}- Document Id
├── groupID
├── groupName
├── adminUID
├── adminUsername
├── createDate
├── creatorUID
├── creatorUsername
├── initialGroupCreate
└── groupMembersSubcollection - (sub-collection)

Then your desired security rules will be as follows :

rules_version = '2';
service cloud.firestore {
    match /databases/{database}/documents {
        // function to check member or not
        function isMemerOrNot(groupId) {
            return exists(/databases/$(database)/documents/groups/$(groupId)/groupMembersSubcollection/$(request.auth.uid)); // Not verified
        }

        // Rule 1: Static fields in the groups collection
        match /groups/{groupId} {
            allow read : if request.auth != null && isMemerOrNot(groupId);
            allow create: if request.resource.data.keys().hasAll([ //making sure all fields are there while creating this document
                'groupID', 
                'groupName', 
                'adminUID', 
                'adminUsername', 
                'createDate', 
                'creatorUID', 
                'creatorUsername', 
                'initialGroupCreate']) &&
            request.resource.data.adminUID == request.auth.uid; // allowed only for admins
            allow update, delete: if false; // No updates or deletes allowed
        }

        // Rule 2: groupMembersSubcollection
        match /groups/{groupId}/groupMembersSubcollection/{userId} { 
            allow read: if request.auth != null && request.auth.uid == userId // Members can read the subcollection
            allow create, delete: if 
            request.auth.uid == get(/databases/$(database)/documents/groups/$(groupId)).data.adminUID;
            allow update: if false; // No updates allowed for subcollection documents
        }
    }
}

Explanation :

1. For Rule 1 :

• The read rule will only allow authenticated users which are also members(for isMemberOrNot function you need to check whether a member with that uid exist or not you can use exists(/databases/$(database)/documents/groups/$(groupId)/groupMembersSubcollection/$(request.auth.uid))
; technique from Access other documents but you need to be sure that the subcollection have the member documentId as a document already exist )
• The create rule allows only the admin to create a document in the groups collection with the specified static fields.
• The update and delete rules are set to false so that no one cannot modify/delete

2. For Rule 2 :

• The read rule allows authenticated users and Group Members to read the documents in the groupMembersSubcollection with the help of their user.uid.
• The create and delete rules allow the admin (using adminUID from parent document to identify) to create or delete documents in the groupMembersSubcollection
• The update rule is set to false to disallow any updates to the documents in the groupMembersSubcollection.

Reference :

• Requiring specific fields in new documents
• Access other documents