I have developed a page inside a website restricted solely to administrators. I am using react nextjs, and I am utilizing Cloud Firestore for data management. Each time the page is accessed, it initiates a read operation in Firestore to verify the user’s type and check that the user is an admin to check if the user is allowed to see the page . I am concerned about potential abuse, where repetitive page openings could result in an undue number of reads. How can I address this issue?

I’m considering implementing Firebase Firestore rules to restrict reads when the user isn’t an admin. This means that the admin page won’t be able to ascertain the user’s type, resulting in no data being returned due to the security rules blocking access. However, I’m also wondering if checking whether the user is an admin in Firestore security rules will incur any costs?