Firestore Security Rules Really Spaghetti-Like? - firebase

Question

while working on Firestore Security rules, I found out that there is no way to specify read/write-access on a Field-Level.
Everything that can be done is to specify access on a Document/Collection level.
But doesn't this enforce really weird database structures?
Consider this example:
[
{
"id": 15,
"name": "room1",
"color": "red",
"owner": "Tim"
},
{
"id": 642,
"name": "room2",
"color": "green",
"owner": "Charles"
},
{
"id": 989,
"name": "room3",
"color": "blue",
"owner": "Jane"
}
]
In this example I want to make it possible for e.g. Jane to read the Fields id name and owner of every entry in the collection, but I don't want her to see the field color of the rooms of the other persons.
This would be of course be possible with a data structure like this:
[
{
"id": 15,
"name": "room1",
"owner": "Tim",
"private_values": {
"color": "red"
}
},
{
"id": 642,
"name": "room2",
"private_values": {
"color": "green"
},
"owner": "Charles"
},
{
"id": 989,
"name": "room3",
"private_values": {
"color": "blue"
},
"owner": "Jane"
}
]
Everything I did was just move the "private"-values (in this case only the color) into another extra collection.
This way I can just set a rule for the root-object, and another extra rule on the object private_values.
Even though this is entirely possible to do, I wouldn't consider it especially clean when extrapolated to a bigger example where there would be for example more groups of users, who all need to be able to see different fields.
Is there a cleaner and better way to do this than the one I just explained, or is there anything else I missed?
Regards

Answer 1

You didn't miss anything. This is exactly what you're supposed to do. Documents in Firestore are the most granular unit for operations.
Note that you can also not read a partial document (you must read all the fields if you want to read any of the fields). If you write a Cloud Function that triggers when a document changes, you always receive the contents of the entire document, and you can't write a trigger for when an individual field changes.