title: Firestore Rules with multi-tenancy?
body: <p>The <a href="https://firebase.google.com/docs/firestore/security/rules-conditions" rel="nofollow noreferrer">Firebase Rules docs</a> suggest building conditions comparing the authenticated user's token (i.e., <code>request.auth</code>) with the target Firestore document(s).  Something like:</p>
  <pre><code>match /posts/{postId} {
    allow read, write: if (request.auth.uid != null) &amp;&amp; 
      (resource.data.tenantId == request.auth.token.tenantId);
  }
  </code></pre>
  <p>However, <code>tenantId</code> doesn't appear to be available in <a href="https://firebase.google.com/docs/reference/rules/rules.firestore.Request#auth" rel="nofollow noreferrer">Firebase Rules</a>  like other related auth fields (e.g., <code>uid</code>, <code>email</code>, <code>email_verified</code>, etc.).</p>
  <p>One option appears to be to add <code>tenantId</code> separately as a <a href="https://firebase.google.com/docs/auth/admin/custom-claims" rel="nofollow noreferrer">custom claim</a> using the <code>firebase-admin</code> SDK. But that would create duplicate info on the user object:</p>
  <pre><code>{
    uid: 'nzjNp3QIfSR6uWy',
    emailVerified: true,
    displayName: 'pickleR'
    ...
    tenantId: 'wubalubadubdub',
    customClaims: { tenantId: 'wubalubadubdub' },
  }
  </code></pre>
  <p>An <a href="https://groups.google.com/forum/#!topic/firebase-talk/z_j9Z2HNjb4" rel="nofollow noreferrer">alternative option</a> appears to be to create a <code>tenants</code> collection in Firestore.   However, that approach seems to introduce needless complexity and inflate the # of required Firestore queries.</p>
  <p><strong>Are there alternatives for accessing the <code>tenantId</code> in Firestore Rules and/or alternative best practices for using Firestore with multi-tenancy?</strong></p>