title: Firestore security rules based on request query value
body: <p>I'm trying to secure requests to a collection to allow any single <code>get</code>, but only to allow <code>list</code> if a specific key is matched.</p>
  
  <p>Database structure is like this:</p>
  
  <pre class="lang-yaml prettyprint-override"><code>projects
    project1
      name: "Project 1 name"
      board_id: "board1"
    project2
      name: "Project 2 name"
      board_id: "board2"
  
  boards
    board1
    board2
  </code></pre>
  
  <p>The Firestore query I'm making from Vue:</p>
  
  <pre class="lang-js prettyprint-override"><code>// Only return projects matching the requested board_id
  
  db
    .collection("projects")
    .where("board_id", "==", this.board_id)
  </code></pre>
  
  <p>The security rules I'd like to have would be something like this:</p>
  
  <pre><code>match /projects/{project} {
    allow get: if true // this works
    allow list: if resource.data.board_id == [** the board_id in the query **]
  
    // OR
  
    allow list: if [** the board_id in the query **] != null
  </code></pre>
  
  <p>I want to do this so you can list the projects in a specific board, but can't just list everything.</p>
  
  <p>Is there a way to access the requested <code>.where()</code> in the security rules or do I need to nest my <code>projects</code> collection inside my <code>boards</code> collection and secure it that way?</p>