Alright, let's get those roles set up in Firebase Firestore. First things first, we need to define roles within Firestore by adding fields to the user document.

1. Head over to your Firebase Console and navigate to Firestore.
2. Find the document for a user (it might be in a collection called "users" or however you've structured your Firestore).
3. Add a new field to the user document, typically named 'role'. This field should indicate the user's role, like "admin", "editor", or "user".

Next up, we need to configure Firestore's security rules to implement role-based permissions. These rules control who can read and write to your database, and they also validate the structure and content of the data.

Here's an example of setting up rules that allow only authenticated users with the 'admin' role to read and write documents:

service cloud.firestore {
  match /databases/{database}/documents {
    // Allow the user to read and write documents only if 
    // they're authenticated and their role is 'admin'
    match /{document=**} {
      allow read, write: if request.auth != null && request.auth.token.role == 'admin';
    }
  }
}

These rules mean:

• The user must be authenticated.
• The custom claim 'role' on the authenticated user token must be 'admin'.

Now, let's talk about setting up custom claims using the Firebase Admin SDK. These custom claims can give users different levels of access (roles).

To set a custom claim using the Firebase Admin SDK:

1. Install the Firebase Admin SDK.
2. Use the 'setCustomUserClaims' method from the Firebase Admin SDK to add a 'role' claim to a user:

// Get your Firebase app
const app = admin.initializeApp();
  
admin.auth(app).setCustomUserClaims(uid, {role: 'admin'}).then(() => {
  // The custom claim 'role' => 'admin' was successfully added to the user
  // This user will now have admin access
}).catch(error => {
  // Handle error
});

After setting this up, the 'role' claim can be accessed in security rules using 'request.auth.token.role'. Firebase SDK will automatically include these custom claims in ID and access tokens.

Just a heads-up, the claim changes might take up to an hour to propagate. If you want those custom claims to take effect immediately, you should force a token refresh in your client application.

This way, you can secure Firebase Firestore using role-based permissions, define various roles within Firestore, and then apply corresponding security rules with custom claims.