title: Whats wrong with this (simple) firebase v2 security rule?
body: <p>Allow me to explain the setup and intention before getting to the actual security rule:</p>
  <ol>
  <li>The Firestore Database starts with a collection called 'users' at its root level.</li>
  <li>The users-collection contains a single document for each (authenticated) user. The name of the document equals the user's email address, and hence the email address must be verified.</li>
  <li>The user's document contains a few fields and a sub-collection called 'history' where data is stored (in a file per month).</li>
  </ol>
  <p>The idea behind using the user's email address as filename is to enable cross platform (or better said cross-sign-in-method) support. For example, you could be signed in with Google on Android and with Apple on an iDevice at the same time, and as long as both accounts use the same email address, both devices share data, which is pretty elegant.</p>
  <p><strong>Edit:</strong>
  The app requests the user's document and its monthly history by calling:</p>
  <pre><code>FirebaseFirestore.instance.collection(&quot;users&quot;).doc(_user?.email);
  FirebaseFirestore.instance.collection(&quot;users&quot;).doc(_user?.email).collection(&quot;history&quot;).doc(&quot;2021-05&quot;);
  </code></pre>
  <p>Now I'm trying to figure out a security rule that allows each user to access only their own data - i.e. the file that matches the user's (verified) email address. After spending some time with the docs, I came up with this simple rule:</p>
  <pre><code>rules_version = '2';
  service cloud.firestore {
    match /databases/{database}/documents {
      match /users/{userId=**} {
        allow read, write: if request.auth != null &amp;&amp; request.auth.token.email == userId &amp;&amp; request.auth.token.email_verified == true;
      }
    }
  }   
  </code></pre>
  <p>What it's supposed to do is: To access a file: The user must be authenticated. The user's email address needs to be equal the file's name, and the email must be verified (last point is also enforced by the app).</p>
  <p>The problem is: PERMISSION_DENIED. Do you have any ideas what's causing it?</p>