Firestore Security Rules - are rules cascading downward? - firebase

Question

I am using the first version of Firestore security rules:
rules_version = '1';
Also, I have the following rule:
service cloud.firestore {
match /databases/{database}/documents {
match /chats/{chatId} {
allow read: if <condition1>
allow write: if false;
match /messages/{document=**} {
allow read: if <condition2>
// allow write: if false;
}
}
}
}
As you can see, I have commented the write operation. Is the chat doc's write operation rule being passed to the match of messages documents? Do I need to explicitly write the condition for the write operation in the nested match? If not, if the write rule is not explicitly declared... will it be false by default?
Update
I have read here that
Security rules apply only at the matched path
so, we have to explicitly define the rules for the nested stuff... but, in the case of write: if false, if it is not declared, will it be false by default?

Answer 1

If you comment some rule, it won't work. Rules works like in CSS for example. The last rule matters most. Here is a small example how you should secure dataase:
rules_version = '2';
service cloud.firestore {
match /databases/{database}/documents {
// {document=**} is equal to all collections and documents in whole database.
// including nested ones, so use it wise.
match /{document=**} {
allow read, write: if false;
}
// Above i restrict access to whole database but here users
// can do something in bookings collection.
// They can make documents in this collection but cannot
// make nested collections because of rule above.
match /bookings/{docId} {
allow read: if resource.data.uid == request.auth.uid || isAdmin()
allow update: if resource.data.uid == request.auth.uid || isAdmin()
allow create: if request.auth != null
}
match /app/{document} {
allow read: if true;
allow write: if false;
}
}
}
function isAdmin() {
return request.auth.token.admin == true;
}