I have a Firebase Cloud Firestore app with a collection of friendships and a collection of friendship-requests. Each document in these collections has the uid of the two friends (for friendships) or potential friends (for friendship-requests). Once the second friend accepts the request, the document is moved from the friendship-requests collection to the friendships collection.
When the app loads, the current user queries the friendships collection for documents that contain their uid, makes a list of the other uid's in those documents (these are the uid's of their friends), then queries the users collection using this list to retrieve data about their friends.
What is a good strategy for how I could write firebase rules to stop people from accessing the data of users that haven't accepted their friend request?