title: What is the best practice for a multi-tenant app with Collection Group Queries in Firestore?
body: <p>What is the best practice for multi-tenant app collection group queries? For example query all invoices for a tenant's customers </p>
  
  <pre><code>/tenant/1/customer/2/invoices
  </code></pre>
  
  <p>If I create a collection group index called <strong>invoices</strong>, and I want to ensure that I can get all <strong>invoices</strong> for tenant 1, how do I do this easily? </p>
  
  <p>I tried setting up some security rules to prevent from querying over the tenants but it still threw Access denied errors since it was still querying across tenants. What would the correct firestore rules look like</p>