title: Firestore: restricting child/field access with security rules
body: <p>If I understand correctly [1], in Firebase there is no way to restrict user's access to data they own, nor a way to hide sensitive columns. Is this better in the newly released Firestore? Does it have workarounds?</p>
  
  <p>One alternative I could think of would be to route such requests through a Cloud Function so as to filter as required, instead of allowing direct access. Might that work?</p>
  
  <p>[1] <a href="https://stackoverflow.com/questions/14296625/restricting-child-field-access-with-security-rules">Restricting child/field access with security rules</a></p>