I was having problems with my security rules and copilot said

Firestore security rules do not allow functions to return values directly from a document.

I can’t find any source for this but it actually resolved my problem. Bellow is my code. By doing everything inside the function it let’s me read noteList documents but if I use the commented lines, it doesn’t.

rules_version = '2';

service cloud.firestore {
    match /databases/{database}/documents {

        match /{documents=**} {
            allow read, update, delete, create: 
                if (request.auth != null && request.auth.uid == resource.data.user_id);
        }
        
        match /notes/{note} {
            allow read: if isUserOwner() || isDocumentShared();
            allow create: if request.auth != null;
            allow update, delete: if isUserOwner() || (isDocumentShared() && getUserLevel());
            // allow update, delete: if isUserOwner() || (isDocumentShared() && (getUserLevel() < 6));
            
            function isUserOwner() {
                return request.auth != null && request.auth.uid == resource.data.user_id;
            }
            
            function isDocumentShared() {
                return request.auth.uid in resource.data.shareArray;
            }
            
            match /noteList/{noteList} {
                allow read, create, update, delete: if isUserParentOwner() || getUserLevel();
                // allow read, create, update, delete : if isUserParentOwner() || (getUserLevel() < 6);
            }
            
            function isUserParentOwner() {
                return request.auth != null && get(/databases/$(database)/documents/notes/$(note)).data.user_id == request.auth.uid;
            }
            
            
            function getUserLevel() {
                return get(/databases/$(database)/documents/notes/$(note)/shareList/$(request.auth.uid)).data.level < 6;
            }
            
            // function getUserLevel() {
            //  return request.auth != null && get(/databases/$(database)/documents/notes/$(note)/shareList/$(request.auth.uid)).data.level;
            // }
            
            
            match /shareList/{shareList} {
                allow read, create, update, delete : if isUserParentOwner() || getUserLevel();
                // allow read, create, update, delete : if isUserParentOwner() || (getUserLevel() < 6);
            }
        }
    }
}

My firestore structure it’s like so:

notes
    noteList
    shareList

My question is: is copilot right? is there any source for this?