title: Firestore rule for unauthenticated users holding a secret key
body: <p>I have a collection of Blobs. A Blob should be readable by any user (authenticated or not) only if the user knows a secret stored in the Blob. Any other read must require the currently logged in user to be the owner of the Blob.</p>
  
  <p>Here's a Blob:</p>
  
  <pre><code>{
      name: "helo",
      owner: {
          "uid-101": true
      },
      secret: "abc123"
  }
  </code></pre>
  
  <p>And here's my current security rule that enforces an authenticated user to be the owner of the Blob in order to read it:</p>
  
  <pre><code>service cloud.firestore {
    match /databases/{database}/documents {
      match /blobs/{id} {
        allow read: if resource.data.owner[request.auth.uid] == true 
      }
    }
  }
  </code></pre>
  
  <p>So the question is: how can I add a rule that would allow <strong>unauthenticated</strong> users to do this:</p>
  
  <pre><code>var query = blobsRef.where("secret", "==", "abc123")
  </code></pre>