title: Firestore rules to allow any authenticated user to write to a subcollection, but only the owner of that subcollection can read?
body: <p>I am very new with Firebase, and I am developing a firestore app that works sort of like an attendence program. Teachers and students will be able to use it, but in a way that only teachers are able to see the students' data. Students will have to log in, in order to have a uid, and when they &quot;attend&quot; a class, a node is created with the uid as the name, with fields that have their name, studentID, etc. The tree would look like this, and the teachers would of course have access to all of their children:</p>
  <pre><code>teachers/{teacherID}/classes/{classID}/students/{studentID}
  </code></pre>
  <p>(I know it's not very shallow, but it makes fetching students based on class more straightforward with less queries. Does this need to be changed too?)</p>
  <p>Of course, the teachers would also have information like name, teacherID, email, etc which students wouldn't be able to read or write/update/delete, but would read the classroom info like roomNumber, timeSlot, etc (of course only teacher can update this info). How would this look so that it is secure and free from abuse? Do I have to worry about Rule Inheritance/Cascading?</p>
  <pre><code>match /teachers/{teacherID} {
        allow read, write: if teacherID == request.auth.uid;
      }
  
  match /teachers/{teacherID}/classes/{classID} {
        allow write: if teacherID == request.auth.uid; //How do I get this value here?
        allow read: if request.auth.uid != null;
      }
  match /teachers/{teacherID}/classes/{classID}/students/{studentID} {
        allow read: if teacherID == request.auth.uid; //and here?
        allow write: if request.auth.uid != null;
      }
  </code></pre>
  <p>Also relevant: teachers and student roles don't exist, since a student could also use this attendence app for student clubs/meetings, where the club would be a &quot;class&quot; and this &quot;student&quot; would then be a &quot;teacher&quot;.</p>