Firebase GET request blocked by simple firebase rules

Question

I have the following collection group query:

const userInRooms = await firestore()
        .collectionGroup('userRooms')
        .where('uid', '==', authenticatedUser.uid)
        .get();

And it works fine. But since I added security rule:

match /rooms/{docId} {
      allow read;
      allow write;
      match /userRooms/{docId} {
        allow read;
        allow write;
      }
    }

userRooms is subcollection in rooms.
It stopped working and I getting:

NativeFirebaseError: [firestore/permission-denied] The caller does not have permission to execute the specified operation.

Answer 1

Cascading the sub-collections rules that way doesn't work for collection group queries. A recursive wildcard must be present at the beginning of the path so it'll match any collections with that name. Try:

match /rooms/{docId} {
  //...
}

match /{path=**}/userRooms/{docId} {
  allow read, write: if true;
}

Do change the rules as required instead of allowing everyone to read the database (unless they are allowed to).