Disallow read-access to nested user collections for disabled users

[pauljohanneskraft]

Problem

Currently, a user has read access to some of its nested collections, even if they have a disabled account. This is the case due to a previous bug of the client applications where it wasn't ensured that a token refresh happens before snapshot listeners are installed during enrollment. With this issue out of the way, we can restrict the rules again.

Solution

Make sure a user is not only authenticated with the respective userId in the Firestore rules, but also check that the user is fully enrolled and enabled.

Additional context

No response

Code of Conduct

• I agree to follow this project's Code of Conduct and Contributing Guidelines