title: Firestore Rule - Querying a document field without exposing the whole collection
body: <p>I have a <code>users</code> collection which has documents containing various fields. Each document ID is the firebase user ID and the fields hold user data.</p>
  <p>I am using the following rule:</p>
  <pre><code>match /databases/{database}/documents {
    // Make sure the uid of the requesting user matches name of the user document.
    match /users/{userId} {
      allow read, update, delete: if request.auth.uid == userId;
      allow create: if request.auth.uid != null;
    }
  }
  </code></pre>
  <p>Users can select &quot;favourite songs&quot; which are saved within an array field. I now have a requirement to query the database for users which have added a certain songs to their favorites. I created the following query:</p>
  <pre><code>FirebaseFirestore db = FirebaseFirestore.getInstance();
  CollectionReference usersRef = db.collection(&quot;users&quot;);
  usersRef.whereArrayContains(&quot;favouriteSongs&quot;, &quot;id_of_song&quot;);
  </code></pre>
  <p>When the query is run the following error is returned:</p>
  <blockquote>
  <p>com.google.firebase.firestore.FirebaseFirestoreException: PERMISSION_DENIED: Missing or insufficient permissions.</p>
  </blockquote>
  <p>I obviously need to alter my Firestore rule to allow a user to query the &quot;favouriteSongs&quot; field; however, I do not want to expose all user data to everyone.</p>
  <p>Is there a way to expose the &quot;favouriteSongs&quot; data (which only holds IDs) and ensure the rest of the user collection is restricted from being read?</p>
  <p>Thanks</p>