second gist for https://medium.com/firebase-tips-tricks/how-to-secure-many-to-many-relationships-in-firestore-d19f972fd4d3 because naming for security rules has to be firestore.rules exactly to have syntax coloring

firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /junction_student_course/{junctionId} {
      allow read:
        if request.auth != null 
        && request.auth.uid == resource.data.studentId;
      
      allow create:
        if request.auth != null
        && request.auth.uid == request.resource.data.studentId
        && junctionId == request.auth.uid + "_" + request.resource.data.courseId;

      allow update:
        if request.auth != null
        && request.auth.uid == request.resource.data.studentId
        && request.auth.uid == resource.data.studentId
        && junctionId == request.auth.uid + "_" + request.resource.data.courseId;
      
      allow delete:
        if request.auth != null
        && request.auth.uid == resource.data.studentId;
    }

    match /courses/{courseId} {
      allow read: if request.auth != null && isAttending(request.auth.uid, courseId);
      allow write: if false;
    }

    function isAttending(studentId, courseId) {
      let junctionId = studentId + "_" + courseId;
      let path = /databases/$(database)/documents/junction_student_course/$(junctionId);
      return exists(path);
    }
  }
}