getDocs(query(orderBy('createdAt', 'desc')))

with rules, i can enforce a query

allow list: if request.query.orderBy.createdAt == "DESC"

How do i make it so users cannot apply query to any other fields

getDocs(query(orderBy('createdAt', 'desc'), where('status', '==', 0)))

status is an additional query

And how do i make it so users may apply queries to specific fields

so…

1. createdAt ==> Enforce
2. price ==> User may add it
3. [any other fields] ==> Do not allow user to apply any sort of queries to it