I made a security mistake in my Firebase app by storing roles in the wrong place here is how I fixed it with proper Firestore rules.