I'm trying to reproduce an example from the official Firestore docs. Everything you need to know is on the screenshot. Is it a bug or am I missing something?
5 Answers
The problem is that there's no actual document at /cities/moscow
-
2What does this answer mean and how do you know there is no document there?– JaySep 20, 2018 at 18:44
-
@Jay, I know there's no document there because I didn't create one. As soon as I add document with the name "moscow" to the "cities" collection the error disappears. Instead I get a message either saying read allowed or not. It's just a confusing and not very descriptive error. Thanks you for the answer!– manidosSep 21, 2018 at 6:14
-
Ah. I see. While there may no document at that location, the bigger picture for the rules issue was that the fields trying to read are not present in any of the locations. I think my answer identifies the issue and provides a solution as well. If it helped, please accept it so it can help others!– JaySep 21, 2018 at 14:05
A bit more explanation would have made manidos's answer a good one.
It seems like resources
should be used only for rules involving data that have been already written; e.g. delete
, read
, update
, etc.
If you want to set rules on data that "will be" written, use getAfter
.
-
If you're writing you can access the data you're going to write via
request.resource
– teoneAug 14, 2020 at 22:25
The issue is - as manidos - pointed out that the document /cities/moscow doesn't exist and hence the document is not accessible. However, a cleaner way to specify your rule is:
allow read: if (resource == null) || (resource.data.visibility == 'public')
It allows an application to query data that doesn't exist without blowing up with a security exception.
The key is to reading through the comments.
Many apps store access control information as fields on documents in the database. Cloud Firestore Security Rules can dynamically allow or deny access based on document data:
and then
// Allow the user to read data if the document has the 'visibility' field set to 'public'
If you look at the example data provided in the guide
let citiesRef = db.collection("cities")
citiesRef.document("SF").setData([
"name": "San Francisco",
"state": "CA",
"country": "USA",
"capital": false,
"population": 860000,
"regions": ["west_coast", "norcal"]
])
There is no 'visibility' field, however there is a name, state country field etc.
If you want to work with that data set, add a 'visibility' field to each city and set it's value to 'public'
citiesRef.document("SF").setData([
"name": "San Francisco",
"visibility": "public"
I'm still learning but the issue with
allow read: if (resource == null) || (resource.data.visibility == 'public')
is when you use such a rule for /cities/{doc}. From what i can see resource == null whenever you search for documents without an exact document ID; the above rule would show everything, private and public, for /cities/{doc} because resource always == null.
From what i've been able to piece together one must make use of the get(...) statement to directly access a document's data whenever within a match that can return 1 or more documents, so
get(/database/...).data.visibility == 'public'