Firebase - Sharing Data - firebase

Question

I am struggling to design a simple data sharing app using firebase. To illustrate, consider a messaging app similar to facebook:
Users can add friends - the request must be accepted
Users can add posts
Users can view all posts submitted by themselves and friends
I can set up the security rules for this, but filtering or denormalizing data seems overly cumbersome and inefficient. A sample data model might look like:
{
"users": {
"user1": {
"friends": {
"user2": { "accepted": true }
}
},
"user2": {
"friends": {
"user1": { "accepted": true }
}
},
"user3": {
"friends": {}
}
},
"posts": {
"generatedId1": {
"message": "blah blah",
"user_id": "user1"
},
"generatedId2": {
"message": "lorem ipsum",
"user_id": "user2"
},
"generatedId3": {
"message": "hello world",
"user_id": "user3"
}
}
}
Security rules to achieve the above requirements would look something like:
{
"rules": {
"users": {
"$uid": {
".read": "$uid === auth.uid",
".write": "$uid === auth.uid"
}
},
"posts": {
"$post": {
".read": "root.child('users').child(data.child('user_id').val()).child('friends').child(auth.uid).child('accepted').val() === true",
".write": "newData.child('user_id').val() === auth.uid"
}
}
}
}
It's probably not quite right, but close enough to illustrate. We can see users can only read and write their own user record, can only add posts with their own user id and can read posts where there is a corresponding accepted friend record.
So my question essentially boils down to how to execute a query that will only return the posts a user is allowed to see? Since security rules are not filters, they do not help us in this case.
My understanding so far is that the posts should be denormalized, basically duplicate the post for each user. This is horribly inefficient - if the user has 100 friends, this means duplicating the data 100 times. Retrospective updates (i.e. adding a new friend or removing an existing one) are also complex to manage.
Another option is to retrieve a users own list of friends and retrieve the posts for those users in separate queries, but again, if a user has 100 friends, this would mean executing 100 separate "queries".
Essentially, I'm attempting to implement a many to many relationship. What is the guidance / best practice here?