title: map fields in firestore security rule
body: <p>How can i deny all other requests other than the below fields</p>
  
  <p>client code:</p>
  
  <pre><code>constructor(private afs:AngularFireStore){}
  
  updateOrder(docId:string){
  
  return this.afs.collection("orderCollection")
  .doc(docId)
  .update({
  
  updatedOn:firebase.firestore.FieldValue.serverTiimestamp(),
  
  updatedBy:{
  uid:currentuser.uid
  email:currentuser.email
  }
  
  })
  
  }
  </code></pre>
  
  <p>In the incoming request there are two fields.<code>updatedOn</code> and <code>updatedBy</code>.
  The request will be allowed only if the request has only the exact fields <code>updatedOn</code> and <code>updatedBy</code>.if the request contains fields other than these two field,it will be denied.</p>
  
  <p>The problem is with the <code>updatedBy</code> field.It is map field.How can i verify the map field using the security rule?  </p>
  
  <p>Here is my security rule</p>
  
  <pre><code> match /orders/{order} {
  
    allow read, write: if false;
    allow create:if false;
  
    allow update:if hasOnlyFields(['updatedOn'])
  }
  
  function hasOnlyFields(keys) {
   return request.resource.data.keys().hasOnly(keys) 
  }
  </code></pre>
  
  <p>using the above function i can easily verify the plain field <code>updatedOn</code>.But how can verify the map field <code>updatedBy</code> using the above function <code>hasOnlyField</code>?.If it is not possible with the function <code>hasOnlyField</code>, how can i verify the incoming request has only the specified map field and plain field?</p>