title: How to create Firebase security rule that allows members of a doc to write that doc
body: <p>My firebase database contains families.  These families have <code>parents</code> and other attributes like address, etc..  I'd like to allow either parent write access to their family document and have read-only access to other families.  How do I express this with the security rules syntax?</p>
  
  <p>Say the data looks like this:</p>
  
  <pre><code>families (collection)
      "TheSmiths" (doc) {
          parents: [{ firstname: "John", role:"dad", userId:"xxxx" },
                    { firstname: "Joan", role:"mom", userId:"yyyy" } ],
          address: "123 Oak Lane"
      }
      "TheJoneses" (doc) etc.
  </code></pre>
  
  <p>My best shot at rules so far looks like this:</p>
  
  <pre><code>service cloud.firestore {
    match /databases/{database}/documents {
      // any user can read the families
      match /families/{anyDocument} {
        allow read: if request.auth != null;
      }
      // here's my problem
      match /families/{anyDocument} {
        allow read, write: if resource.data.parents.userId == request.auth.uid;
      }
    }
  }
  </code></pre>
  
  <p>The second rule is trying to say, "allow read and write of a family doc if the user's id is stored in one of the parents.  The problem I'm having is syntax for "one of the" parents.  Maybe I could say:</p>
  
  <pre><code>if ((resource.data.parents[0].userId == request.auth.uid) ||
      (resource.data.parents[1].userId == request.auth.uid))
  </code></pre>
  
  <p>Can I?  Even if I can, the data might contain more or less than two adults who can be considered parents for the purpose of editing.  Am I even close?</p>