The following record fields are available:
{#each fieldNames as name}
{#if !hiddenFieldNames.includes(name)}
{name}
{/if}
{/each}
The request fields could be accessed with the special @request filter:
@request.headers.*
@request.query.*
@request.body.*
@request.auth.*
You could also add constraints and query other collections using the @collection filter:
@collection.ANY_COLLECTION_NAME.*
Example rule:
@request.auth.id != "" && created > "2022-01-01 00:00:00"