How can I safely list non-existent documents in Firestore without a variable read error?

When you run a list query that potentially matches non-existent documents, the security rules engine evaluates each possible document—even if a document isn’t in your database. That means any reference to the document’s fields (via the resource variable) will fail when the document doesn’t exist, resulting in the variable read error you see.

To fix this you must avoid directly referencing resource.data in a list rule when the document might not exist. One solution is to use the exists() function (and get() if needed) to check for document presence. For example, instead of writing:

JAVASCRIPTCopied
match /tenants/{tenantId} {
  allow read: if isAuthenticated() && (resource == null || isSuperAdmin() || isTenantMember(resource.data));
}

you can rewrite the rule to use exists() like so:

JAVASCRIPTCopied
match /tenants/{tenantId} {
  allow read: if isAuthenticated() && (
    // If the document does not exist, we let the list query proceed
    !exists(/databases/$(database)/documents/tenants/$(tenantId)) ||
    // Otherwise, enforce that the user is a super admin or a tenant member
    isSuperAdmin() || isTenantMember(get(/databases/$(database)/documents/tenants/$(tenantId)).data)
  );
}

Here’s what happens in this rule:

• The check !exists(...tenantId) ensures that if the document isn’t in the database (so a stale reference), the rule won’t attempt to access its fields.
• If the document does exist, then the rule uses get() to safely retrieve its data and then calls isTenantMember() or accepts isSuperAdmin().

Using this pattern, the list query won’t fail when one or more of the queried document IDs don’t exist, and you prevent the variable read error in your list clause.

This pattern satisfies your request without causing permission denied errors for non‑existent documents.