title: Firestore read rules with self condition
body: <p>I'm currently trying to build small app on firebase as an evaluation of it.
  It looks interesting and super productive, but I have one problem with firestore rules.</p>
  
  <p>I have one collection (games) with objects looking like this:</p>
  
  <pre><code>{
      "name":String,
      "description":String,
      "owners": 
      {
          "uid": String
          "uid2": String
      }
  }
  </code></pre>
  
  <p>And rules set like this:</p>
  
  <pre><code>service cloud.firestore {
      match /databases/{database}/documents {
          match /games {
              match /{game} {
                  allow write: if request.auth != null &amp;&amp; request.resource.data.owners[request.auth.uid] == 'ADMIN';
                  allow update: if request.auth != null &amp;&amp; resource.data.owners[request.auth.uid] == 'ADMIN';
                  allow read: if request.auth != null &amp;&amp; resource.data.owners[request.auth.uid] == 'ADMIN';
              }
          }
      }
  }
  </code></pre>
  
  <p>While write, update work fine. Read only works for single documents.
  When I try to read a collection I get access error as if user did not have right to it. The part that makes it not work is </p>
  
  <pre><code>resource.data.owners[request.auth.uid] == 'ADMIN'.
  </code></pre>
  
  <p>Adding a <code>where("owners."+auth.uid,"==", 'ADMIN')</code> to collection query does not help either.</p>
  
  <p>What am I doing wrong here? Is there a suggested approach in firebase firestore for similar scenario?</p>
  
  <p>EDIT:
  I tried adding 'get' and 'list' rules like this:</p>
  
  <p><code>allow list: if request.auth != null;</code></p>
  
  <p><code>allow get: if request.auth != null &amp;&amp; resource.data.owners[request.auth.uid] == 'ADMIN';</code></p>
  
  <p>It didn't work as expected. I expected it to allow me to list documents with <code>where</code> but if there is a document that I could not <code>get</code> I expected to get "Missing or insufficient permissions." What I was able to do was to list ALL documents but not read some of them directly (<code>get</code> rule works when trying to fetch single document but not when listing them from a collection).</p>
  
  <p>EDIT 2: Looks like according to @MikeMcDonald my expectation was correct, but it is currently bugged. Waiting for the fix.</p>
  
  <p>EDIT 3: It is now working fine with rules to get and list set in this way:</p>
  
  <p><code>allow get, list: if request.auth != null &amp;&amp; resource.data.owners[request.auth.uid] == 'ADMIN';</code></p>