How can I check for an object's field value within an array in Firestore security rules?

In Firestore security rules you cannot iterate over an array of objects or filter out a specific field (like groupId) without referencing an index. The rules language provides a few list operations on map keys but does not include functions that let you examine each element of an array of maps in a general way such as "if any group's groupId is equal to '12345'."

For example, this won't work:

PLAINTEXTCopied
allow read, write: if "12345" in resource.data.groups.???

Workarounds

1. Normalize Your Data

   Instead of storing an array of objects, you could add a separate field (or even a subcollection) that contains just the list of group IDs. For example:

   JAVASCRIPTCopied
   {
     name: "Tom",
     groups: [
       { groupId: "12345", moreInfo: "bla" },
       { groupId: "67890", moreInfo: "bla" }
     ],
     groupIds: ["12345", "67890"]     // New field
   }

   Then your rule can simply be:

   PLAINTEXTCopied
   rules_version = '2';
   
   service cloud.firestore {
     match /databases/{database}/documents {
       match /users/{docId} {
         allow read, write: if "12345" in resource.data.groupIds;
       }
     }
   }

2. Use a Subcollection

   Alternatively, you could store each group membership as its own document in a subcollection (e.g., /users/{userId}/groups/{groupId}) so that checking for access is as simple as validating that a specific document exists.

Conclusion

Directly querying an inner field of an object within an array is not supported in Firestore security rules. The recommended approach is to restructure your data so that the values you need to check (like group IDs) are stored in a way that rules can easily reference them.