Firebase security rules with users collection for Signin

I have a "users" collection to store some user data such as city, age, etc. I use firebase Authentication as a document key.

An example path is: /users/ZXHSGdhjfdfwd

I want users to read-only their data while signup/signin. So I have a rule:

rules_version = '2';
service cloud.firestore {

  match /databases/{database}/documents {
    match /users/{userId} {
      allow read, update, delete: if request.auth != null && request.auth.uid == userId;
      allow create: if request.auth != null;
    }
    match /posts/{post}/{document=**}{
      allow read, write: if request.auth != null;
    }
  }
}

This doesn't work, and rules monitors show an error. As a result, users cannot sign in as I read users' collections as part of the sign-in process.

When I remove userId and change the rule to:

match /users/{userId} {
      allow read:  if (request.auth != null);
      allow create: if request.auth != null;
    }

It works, however, does that mean that userID from firestore (key) and auth.uid does not match, or one of them is null?

This is a pretty standard rule. Why is it not working?

Thanks