title: Accessing a deeper level document if email is found along the way in cloud firestore
body: <p>I'm a teacher who has built a webapp for my school to store assessment data basically. The database has this structure:</p>
  <pre><code>matrix -&gt; mStudents -&gt; mStudents--active -&gt; *STUDENT* -&gt; courseList -&gt; *COURSE* -&gt; assessments -&gt; *ASSESSMENT*
  </code></pre>
  <p>there are many STUDENT documents, and each have a few COURSE documents, and each have a few ASSESSMENT documents - this is where the grade data is. Initially, I allowed teachers to write freely, but I want to up the security level a bit and allow teachers to only write in COURSE documents (and deeper than that) that have their email listed in them. Here is what I've tried:</p>
  <h2>Attempt #1</h2>
  <pre><code>match /matrix/mStudents/mStudents--active/{studentDoc=**} {
   allow write: if request.auth.token.email == resource.data.teacher_email;
  }
  </code></pre>
  <p>This would work(?) if all the ASSESSMENT documents also had teacher_email in them, but I would much rather prefer a cleaner solution.</p>
  <h2>Attempt #2</h2>
  <pre><code>  match /matrix/mStudents/mStudents--active/{student}/courseList/{course=**} {
          allow write: if request.auth.token.email == get(/databases/$(database)/documents/matrix/mStudents/mStudents--active/$(course)).data.teacher_email;
  }
  </code></pre>
  <p>I feel like this should work but alas no luck here. Maybe the recursive wildcard can't be used as a variable?</p>
  <p><strong>This is basically my question then: is it possible to access a deeper document by retrieving user credentials along the way, or should I just try to use attempt #1?</strong></p>