Subcollections in Firebase - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding Firestore Subcollections Structure

In Firestore, you have a collection named users. Each user document has a subcollection called orders. What is the correct path to access the orders subcollection for a user with ID user123?

A orders/users/user123

B users/user123/orders

C users/orders/user123

D orders/user123/users

💡 Hint

Think about the hierarchy: collection > document > subcollection.

In Firestore, subcollections are nested under a specific document. So to access the orders subcollection for user user123, you first specify the users collection, then the document user123, then the orders subcollection.

❓ Architecture

intermediate

Best Practice for Storing User Messages in Firestore

You want to store messages sent by users in a Firestore database. Each user can have many messages. Which design uses subcollections correctly and scales well?

A Create a <code>messages</code> collection with documents named by user ID, each containing all messages as fields.

B Create a single <code>messages</code> collection with all messages, each document containing a user ID field.

C Create a <code>users</code> collection, each user document has a <code>messages</code> subcollection with individual message documents.

D Store all messages in a single document inside <code>users</code> collection under a <code>messages</code> field as an array.

💡 Hint

Consider how Firestore handles large arrays and document size limits.

Using a messages subcollection under each user document allows efficient querying and avoids document size limits. Large arrays or storing all messages in one document can cause performance and size issues.

❓ Configuration

advanced

Firestore Security Rules for Subcollections

You want to write Firestore security rules to allow users to read and write only their own orders subcollection documents. Which rule snippet correctly enforces this?

Firebase

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /users/{userId}/orders/{orderId} {
      allow read, write: if request.auth.uid == userId;
    }
  }
}

A request.auth.uid == userId

B request.auth.token.email == userId

C request.auth.uid != userId

D request.auth.token.admin == true

💡 Hint

Check how to compare authenticated user ID with document path variable.

The rule must check that the authenticated user's ID matches the userId in the document path to restrict access to their own orders.

❓ service_behavior

advanced

Query Behavior on Firestore Subcollections

You run this query in Firestore:

db.collectionGroup('orders').where('status', '==', 'shipped').get()

What does this query return?

A Only documents in the <code>orders</code> subcollection of the root collection.

B An error because <code>collectionGroup</code> cannot be used with subcollections.

C Documents in the <code>orders</code> subcollection of the first user document only.

D All documents in all <code>orders</code> subcollections across the database with status 'shipped'.

💡 Hint

Think about what collectionGroup queries do.

collectionGroup queries search all subcollections with the given name across the entire database, regardless of parent document.

❓ security

expert

Preventing Unauthorized Access to Nested Subcollections

You have a Firestore database with users collection. Each user document has a projects subcollection, and each project document has a tasks subcollection. You want to ensure users can only read and write tasks in their own projects. Which security rule snippet correctly enforces this?

Firebase

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /users/{userId}/projects/{projectId}/tasks/{taskId} {
      allow read, write: if request.auth.uid == userId;
    }
  }
}

A request.auth.uid == userId

B request.auth.uid == projectId

C request.auth.token.email == userId

D request.auth.uid == taskId

💡 Hint

Remember the user ID is in the document path, not project or task IDs.

The rule must check that the authenticated user ID matches the userId in the path to restrict access to their own nested subcollections.