Firestore security rules with reference fields

Question

I am a bit stuck here as there is no way to debug those rules. I'd appreciate help with below rules.

I want to access:

/modules/module-id/sessions/session-id/parts/

The comparison with null in the first part of hasCompletedPrerequisiteSession() works well, the second part doesn't!

The path /modules/moduleId/sessions/sessionId/prerequisite points to a reference field.

service cloud.firestore {
    match /databases/{database}/documents {

      function hasCompletedPrerequisiteSession(moduleId,sessionId) {
                // this part works well                                   
        return getPrerequisiteSession(moduleId,sessionId) == null ||
           // !!! this part does not work !!!
           hasCompleted(getPrerequisiteSession(moduleId,sessionId).id);
      }

      function getPrerequisiteSession(moduleId,sessionId) {
        return get(/databases/$(database)/documents/modules/$(moduleId)/sessions/$(sessionId)).data.prerequisite;
      }

      function hasCompleted(sessionId) {
        return exists(/databases/$(database)/documents/progress/$(request.auth.uid)/sessions/$(sessionId));
      }

      match /modules/{moduleId}/sessions/{sessionId}/parts/{partId} {
        allow read: if hasCompletedPrerequisiteSession(moduleId,sessionId);
      }
    }
  }

(If I store the session ID as a string instead of a reference to the session, it works fine.)

Edit

Questions

1. Reference field in security rules. Assuming modules/moduleId/owner points to a field of the type reference. What is the proper way to get the id of the referenced document?get(../modules/moduleId).data.owner.data.id or get(../modules/moduleId).data.owner or something else?

Answer 1

From Firebase support:

It seems that in your use case, you want to get the document name (sessionId) from the value of your reference field (prerequisite), unfortunately, this is not currently supported by Firestore security rules. I would suggest that you store only the sessionId as String on your prerequisite field, or you can also add String field for the sessionId. Keep in mind that the exists() and get() functions only allow you to check if a document exists, or retrieve the document at the given path.