I’m experiencing an issue with Firestore security rules. I have two versions of a rule that checks if a document exists, but only one of them works.

The inline version works fine:

match /orgs/{org} {
  allow get: if exists(/databases/$(database)/documents/rbac/$(org)/users/$(request.auth.uid));
}

However, when I move the same logic into a function, it doesn’t work:

function isUser(org) {
  return exists(/databases/$(database)/documents/rbac/$(org)/users/$(request.auth.uid));
}

match /orgs/{org} {
  allow get: if isUser(org);
}

Could you help me understand what I’m doing wrong and why the function-based approach is not working?