Firestore Security Rules

auth-check.js

import * as firebase from "firebase/app";
import { db } from "./db";
import "firebase/auth";
/**
 * Check if the account used for login is valid
 *
 * @returns {Promise}
 */
function validAccountCheck() {
  const user = firebase.auth().currentUser;

  return db
    .collection("Employees")
    .doc(user.uid)
    .set(
      {
        displayName: user.displayName,
        email: user.email,
        photoURL: user.photoURL
      },
      {
        merge: true
      }
    )
    .then(() => true)
    .catch(err => {
      // Not a white-listed domain
      console.log(err);
      return false;
    });
}

export { validAccountCheck };

firestore-security.js

service cloud.firestore {
  match /databases/{database}/documents {
  function validAccount(userEmail){
      return userEmail.split('@')[1] == 'example.com' || userEmail.split('@')[1] == 'othersite.com';
  }


    match /Employees {
                match /{userId}{
                    allow read: if request.auth != null && validAccount(request.auth.token.email);

                    allow write: if request.auth.uid == userId  /// Avoid editing another person's profile
                                    && validAccount(request.auth.token.email);
                }
            }
            match /{document=**} {
      allow read, write: if request.auth.uid != null && validAccount(request.auth.token.email);
    }
  }

}