title: Firebase security rules for friends list
body: <p>Is there an efficient way to implement security rules on a list of nodes in Firebase, to prevent many network connections and queries?</p>
  
  <p>I'm doing an application with a user list, and each user has a list of posts that they want to share with people in their friends list (basically a bit like a social network).</p>
  
  <p>One way is to have a "/users" table where each user has a list of friends "/users/xxx/friends" under their user node, and a list of their own posts "/users/xxx/posts". To query the recent posts of all their friends requires many Firebase queries, one to each of the user's friends' "posts" node.</p>
  
  <pre><code>{
    "users" : {
      "FKOZlhz05xrVvKGl2" : {
        "name" : "John Smith",
        "friends" : {
          "Tz7Ztv546lOaowrq2" : true
        }
       "posts" : {
          "-Kc-n235d5" : {
            "text" : "This is a status update"
          }
      },
      "Tz7Zt546jlOaowrq2" : {
        "name" : "Helen test",
        "friends" : {
          "FKOZlhz05xrVvKGl2" : true
        },
        "posts" : {
          "-Kc-neow05" : {
            "text" : "Another status update"
          },
          "-Kc-ab3243" : {
            "text" : "Feeling confused"
          }
        }
      }
  }
  </code></pre>
  
  <p>This requires many simultaneous queries if someone wants to query "posts" for everyone in their friends list, because Firebase wouldn't allow someone to query the whole "users" table and filter out any that are not in the friends list.</p>
  
  <p>Another option is to have a separate "/posts" list for all users which can be queried in one action. However in this case one also can't implement security rules to filter out only posts for your friends, because Firebase doesn't allow filtering the "posts" list based on security rules.</p>
  
  <p>The only way I can see of looking up the "posts" list for only people in your friends list, is to fire off multiple simultaneous queries for each friend.</p>