title: Using the reference data type in Firestore Rules
body: <p>I want to define a rule that allows a user only to update his own items and an admin to update all.</p>
  
  <p>As <code>uid_of_logged_in_administrator</code> I should be able to update both <code>items/item__1</code> and <code>items/item__2</code> - this works.</p>
  
  <p>As <code>uid_of_logged_in_user</code> I should be allowed to update <code>items/item__1</code> but not <code>items/item__2</code> - this does not.</p>
  
  <p>Obviously the problem is I do not know what the data type [<strong>Cloud Firestore references</strong>] represents in rules.</p>
  
  <p>I've read through the documentation on rules and been trying different things.</p>
  
  <pre><code>if request.auth.uid == resource.data.owner                           | false
  if request.auth.uid == resource.data.owner.id                        | false
  if request.auth.uid == resource.data.owner.__id__                    | false
  if resource.data.owner is string                                     | false
  if resource.data.owner is path                                       | true
  if resource.data.owner == path('users/uid_of_logged_in_user')        | false 
  if request.auth.uid == resource.data.owner[6]                        | false
  </code></pre>
  
  <p>So it seems that the resource.data.owner is a path. </p>
  
  <p><strong>But how do I obtain the id for this reference?</strong></p>
  
  <p>One of my reasons for creating this reference is then the owner property can either be a box or an user. eg. <code>{owner: '/users/uid_of_logged_in_user'}</code>, <code>{owner: '/boxes/box__1'}</code></p>
  
  <p>I could of course just add a property with the users uid as a string to the item instead of as a reference. But then i would need to have two diffrent properties for box or user as owner.</p>
  
  <h2>My rules</h2>
  
  <pre><code>service cloud.firestore {
    match /databases/{database}/documents {
  
      function isAdmin() {
        return get(/databases/$(database)/documents/users/$(request.auth.uid)).data.role == "admin";
      }
      function isAuth() {
        return request.auth.uid != null;
      }
  
      match /users/{uid} {
        allow read:   if isAuth();
        allow write:  if isAdmin();
      }
  
      match /items/{umbId} {
        allow read:   if isAuth();
        // THIS IS THE ISSUE. IT DOESENT WORK.
        allow update: if request.auth.uid == resource.data.owner 
        allow write:  if isAdmin();
      }
    }
  }
  </code></pre>
  
  <h2>The structure of my database is as follows</h2>
  
  <pre><code>users 
    # documentid(uid_of_logged_in_user)
      - name: 'My name'                                           // string
      - address: 'My address'                                     // string
    # documentid(uid_of_logged_in_administrator)
      - name: 'Another one'                                       // string
      - address: 'His address'                                    // string
      - role: 'admin'
  
  items
    # documentid(item__1)
      - owner: 'users/uid_of_logged_in_user'                      // reference
      - name: 'The first item'                                    // string
    # documentid(item__2)
      - owner: 'users/uid_of_logged_in_administrator'             // reference
      - name: 'The first item'                                    // string
  
  boxes
    # documentid(box__1)
      - name: 'First Box'                                         // string
    documentid(box__2)
      - name: 'Second box'                                        // string
  </code></pre>