firebase firestore subcollection access rules

Question

I have a firestore with a collection called "children" and a subcollection called events. The children documents have an array called "caretakers" which contains the authids for users that should have access to this document. My question is, what is the right way to secure the subcollection. I am currently doing the following:

match /children/{childId} {
    allow read, write, delete, list: 
        if request.auth.uid in resource.data.caretakers;
    allow create:
        if true;
}

 match /children/{childId}/events/{eventId} {
    allow read,write,delete,get:
    if request.auth.uid in get(/databases/$(database)/documents/children/$(childId)).data.caretakers
  }

Something about that get(...) doesn't feel right to me. Is that necessary? Do I really need to specify rules separately for each subcollection? or if the parent document has permissions.. those permissions should cascade down to subcollections?

Answer 1

With your current structure unfortunately you will indeed need to read the parent document to check against its caretakers role for each subdocument. What's even worse is that this makes queries impossible, as you can't read from the parent document when querying events.

The common workaround for this is to duplicate the caretakers into each events document, so that you can query for it there, and the rules can then secure that only that query is allowed.