title: Firebase Firestore: Nested Security rules for global read access
body: <p>This is a follow up on this post: <a href="https://stackoverflow.com/questions/65107041/firebase-firestore-security-rules-read-all-nested-docs-based-on-resource-but/65112388#65112388">Firebase Firestore security rules - read all nested docs based on resource (but it&#39;s null)</a></p>
  <p>I'm having a hard time figuring how Firestore works!</p>
  <p>So let's say I have this Bases collections:</p>
  <pre><code>{
    name: &quot;Base 1&quot;,
    roles : {
       user_1: true
    }
  },
  {
    name: &quot;Base 2&quot;,
    roles : {
       user_2: true
    }
  }
  </code></pre>
  <p>I want to fetch all Base where user_1 is in resource.roles. I do :
  <code>db.collection('bases').where('roles.user_1', '==', true).get()</code></p>
  <p>And it works great. All server side so no one can try to alter the filter: All good.</p>
  <p>But, I want to enforce this filter with a security rule in firestore. Just to be sure! So I've wrote:</p>
  <pre><code>function hasRole(){
      return request.auth.uid in resource.data.roles
  }
  match /bases/{document=**}{
      allow read: if true; // signedIn() &amp;&amp; hasRole();
  }
  
  match /bases/{baseId}{
      // allow read: if signedIn() &amp;&amp; hasRole();
      allow update, delete: if false &amp;&amp; signedIn()
      allow create: if signedIn()
  }
  </code></pre>
  <p>And it works when I try to access a specific resource in the rule simulator but now my <code>.get()</code> method receive a not-enough permission. Funny enough, When I uncomment the read into <code>/bases/{baseId}</code> it works perfectly (if I comment the <code>/bases/{document=**}</code> of course).</p>
  <p>So I can make it work but I'd still like to understand why the {document=**} rule work in simulator and not when I'm trying to fetch from a server.</p>
  <p>Thanks a lot for your help :)</p>
  <p>P.S: I didn't find a way to simulate a nodejs .get() in the simulator which is not super convenient to learn this stuff. Any resource on that will be read and helpful.</p>