Firebase rules - Simulator says yes, code says no

I'm working on a Flutter app using Firebase as a backed. I've set up group based roles in Firebase and the rules simulator in Firebase tells me the user I'm testing has access to the document. When I do a query in my Flutter code, I can see it finds the document and I can see it for a split second before it changes it mind and I get a "Listen for query at students failed: Missing or insufficient permissions." and the document is removed from the snapshot.

The query I use in the Flutter code is as follows:

Firestore.instance.collection('students').where('test', arrayContains: userID).orderBy('name').snapshots()

I have been playing with the document and tried different approaches for the current user to query for the document, and just to test it out I created an array with the userId and look for that.

If I completely skip the rules and just put the "need to be logged in" as requirement then I get a document back but as soon as I use the role based one then it's back to the drawing board. The rules I've set up are:

service cloud.firestore {
  match /databases/{database}/documents {
     match /students/{student} {
        function isSignedIn() {
          return request.auth != null;
        }
        function getRole(rsc) {
          return rsc.data.roles[request.auth.uid];
        }
        function isOneOfRoles(rsc, array) {
          return isSignedIn() && (getRole(rsc) in array);
        }
        allow read, write : if isOneOfRoles(resource,['teacher', 'student', 'parent']);
     }
  }
}

Any idea what's causing this?