If you are using Firestore Collection Group, you need to specifiy special rules for the permission.
Indexed
I store data in blog/post, where I want to allow query across post using the following composite index
Collection ID: post Fields indexed: processed Ascending date Descending Query scope: Collection group
Query via collection group
let query = db.collectionGroup('post').where('processed', '==', false).orderBy('date', 'desc').limit(100)
Firestore Rules
// collection group
match /{path=**}/post/{postId} {
allow read: if true;
}