For the life of me, I cannot understand why the following is resulting in a false for allowing writes. Assume my users collection is empty to start
false
users
I solved it by using writeFields. Please try this rule.
writeFields
allow write: if !('role' in request.writeFields);
In my case, I use list to restrict updating fields. It works, too.
list
allow update: if !(['leader', '_created'] in request.writeFields);