title: Firebase Firestore - security rule based on "where" query parameters
body: <p>I'm trying to secure requests to a collection to allow any single <code>get</code>, but to allow <code>list</code> only if a specific key is matched.</p>
  
  <p>Database structure is like this:</p>
  
  <pre class="lang-yaml prettyprint-override"><code>posts
    post1
      content: "Post 1 content"
      uid: "uid1"
    post2
      content: "Post 2 content"
      uid: "uid1"
    post3
      content: "Post 3 content"
      uid: "uid2"
  </code></pre>
  
  <p>The Firestore query I'm making from Vue:</p>
  
  <pre class="lang-js prettyprint-override"><code>// Only return posts matching the requested uid
  
  db
    .collection("posts")
    .where("uid", "==", this.uid)
  </code></pre>
  
  <p>The security rules I'd like to have would be something like this:</p>
  
  <pre><code>match /posts/{post} {
    allow get: if true // this works
    allow list: if [** the uid in the query **] != null
  </code></pre>
  
  <p>I want to do this so you can list the posts of a specific user if you know their <code>uid</code> but can't list all <code>posts</code> of the system.</p>
  
  <p>Is there a way to access the requested <code>.where()</code> in the security rules or how can I write such rule or structure my data in this case?</p>
  
  <p><strong>Relevant &amp; credits:</strong></p>
  
  <ul>
  <li><p>Seemingly, I can make a request on a query's <code>limit</code>, <code>offset</code>, and <code>orderBy</code>. But there's nothing on <code>where</code>. See: <a href="https://firebase.google.com/docs/firestore/security/rules-query" rel="nofollow noreferrer">#1</a> &amp; <a href="https://firebase.google.com/docs/reference/rules/rules.firestore.Request" rel="nofollow noreferrer">#2</a>.</p></li>
  <li><p>I copy-pasted much from <a href="https://stackoverflow.com/questions/48961574/firestore-security-rules-based-on-request-query-value">this question</a>. I don't see how the accepted answer answers the question. It seems like it answers another case where a user is allowed to <code>list</code> some other users' posts. That is not my case; in my case, what's public is public. So, it doesn't answer the main question in my case, it seems.</p></li>
  </ul>