title: Firebase security rules for child items in arrays
body: <p>I have the following data structure in my firebase:</p>
  
  <pre><code>{
      "groups" : {
          "-KEFQ7rTQscPX4hqn6ec" : {
            "createdBy" : "b5cd3a86-108e-4ef3-9ab8-8a1e4da7491c",
            "description" : "Test",
            "isPublic" : true,
            "title" : "T1"
          },
          "-KEFQao_Wd-Y-nLzIx2e" : {
            "createdBy" : "b5cd3a86-108e-4ef3-9ab8-8a1e4da7491c",
            "description" : "B",
            "isPublic" : false,
            "title" : "E"
          }
  }
  </code></pre>
  
  <p>and am trying to achieve the following:</p>
  
  <ol>
  <li>Everybody can read all groups with "isPublic" == true</li>
  <li>Only logged in users can see the groups that they have created</li>
  </ol>
  
  <p>My first approach is:</p>
  
  <pre><code>{
    "rules": {
      "groups": {
        ".read": true,
        "$id": {
          ".read": "data.child('isPublic').val() === true"
          }
        }
    }
  }
  </code></pre>
  
  <p><a href="https://stackoverflow.com/questions/26530334/firebase-security-rule-for-array-of-messages">This stackoverflow post</a> explains why it doesn't work, but I couldn't figure out how I can make it work.</p>
  
  <p>Edit 1:</p>
  
  <p><a href="https://stackoverflow.com/questions/19891762/firebase-security-rules-public-vs-private-data">This post</a> has a solution for the public/private problem (my 1. question) but not for the second question.</p>
  
  <p>Edit 2:</p>
  
  <p>Thanks to @VonD for the working solution for the public/private problem.</p>
  
  <p>With this solution the problem with public/private is solved. Considering that a private group has many members and the user ids of them would be stored in another array "members" - how would I only allow access to the group if I am a member?</p>
  
  <pre><code>"privateGroups": {
          "b5cd3a86-108e-4ef3-9ab8-8a1e4da7491c": {
              "-KEFQao_Wd-Y-nLzIx2e" : {
                  "createdBy" : "b5cd3a86-108e-4ef3-9ab8-8a1e4da7491c",
                  "description" : "B",
                  "title" : "E",
                  "members": [userId1, userId2, userId3...]
              }
          }
      }
  </code></pre>