title: Cloud Firestore: Query secured documents by field content
body: <p><strong>EDIT: Seems to be an open issue in Firestore. Also see <a href="https://stackoverflow.com/questions/46667912/firestore-read-rules-with-self-condition">this post</a>.</strong></p>
  
  <p>In Google Cloud Firestore, I want to model a collection of <code>group</code>s. Each group contains a <code>name</code>, the list of it's <code>user</code>s and some <code>secretGroupData</code>. For me, the natural way to do this would be:</p>
  
  <pre><code>/groups
      /group1 {
          name: "Group 1"
          users: { //object can be queried, simple array not
            "user1": true,
            "user5": true
          }
          secretGroupData: ...
        }
      /group2 { ... }
  </code></pre>
  
  <p>Given a user like <code>user1</code>, I want to query all groups he is member of. This query works fine:</p>
  
  <pre><code>groupsRef.where("users.user1", "==", true)
  </code></pre>
  
  <p>However, I want to secure the group data. This query only works, when all groups are readable for all users. When I protect the group to be readable only by the group members, by the rule</p>
  
  <pre><code>match /groups/{groupId} {
      allow read: if resource.data.users[request.auth.uid] == true;
  }
  </code></pre>
  
  <p>the above query does not work any more, because as soon as it sees a group where the current user is <em>not</em> a member of, read access is denied and <a href="https://firebase.google.com/docs/firestore/security/secure-data#shallow_queries" rel="nofollow noreferrer">the whole query fails</a>.</p>
  
  <p>What is the best solution for this problem in Firestore? Should I</p>
  
  <ol>
  <li>tell Firestore to return only the allowed <code>group</code>s and ignore the other ones, instead of throwing an error? If so, how can I achieve this?</li>
  <li>make the <code>group</code>s readable for all <code>user</code>s and move the <code>secretGroupData</code> into subcollections, where I can then restrict the access to just the group members</li>
  <li>add redundancy by adding the IDs of all groups of a user into the user's profile document (<code>/users/user1/groupIds: ["group1"]</code>), so I know the groups beforehand and can query them by ID</li>
  <li>use a totally different solution?</li>
  </ol>
  
  <p>Thank you very much for your ideas.</p>