Query firestore in flutter: permission denied, what to do - flutter

Question

I am trying to query some data from private devices. My rules are set as following:
match /private_devices/{device} {
function userHasKey() {
return request.auth != null && exists(/databases/$(database)/documents/users/$(request.auth.uid)/keys/$(device));
}
allow read: if (userHasKey())
}
My flutter code:
Stream<QuerySnapshot> getPrivateDevices(List<String> keyList) {
return private.where('UDID', whereIn: keyList).snapshots();
}
I use a list to import the keys from:
Stream<QuerySnapshot> getUserKeys(User user) {
return users.document(user.uid).collection('keys').snapshots();
}
And my user rules:
match /users/{userId} {
allow read, write: if (request.auth != null && request.auth.uid == userId)
}
match /users/{userId}/keys/{key} {
allow read, write: if (request.auth != null && request.auth.uid == userId)
}
Edit: my collection references:
final CollectionReference devices = Firestore.instance.collection("devices");
final CollectionReference users = Firestore.instance.collection("users");
final CollectionReference private = Firestore.instance.collection("private_devices");
I get a following permission error in my console:
Listen for Query(private_devices where UDID in [F8MXi2JzwYvIAoVRYG5f] order by __name__) failed: Status{code=PERMISSION_DENIED, description=Missing or insufficient permissions., cause=null}
I/System.out(27625): com.google.firebase.firestore.FirebaseFirestoreException: PERMISSION_DENIED: Missing or insufficient permissions.
I also tested my rules in the rules playground, and everything worked fine. I know it has to do with querying, but have no clue how to progress forward.
I have also noticed that when i try to get a single document with private.document(keyList[0]).get(), I actually get back the data.
Any help is welcome, thank you in advance.

Answer 1

Your rules don't allow the query because security rules are not filters. Be sure to read that documentation carefully, as well as this blog.
Security rules are not going to cross-reference another document for each document in the query result. That just doesn't scale in the way that Firestore requires. You can do that for individual document gets, but not for queries.
What you will have to do instead is put all of the data necessary for the filter into documents in a single collection, and make sure the client is applying a filter that matches only the documents they are allowed to read by the rule.