17

I'm trying to reproduce an example from the official Firestore docs. Everything you need to know is on the screenshot. Is it a bug or am I missing something?

enter image description here

5 Answers 5

19

The problem is that there's no actual document at /cities/moscow

3
  • 2
    What does this answer mean and how do you know there is no document there?
    – Jay
    Sep 20, 2018 at 18:44
  • @Jay, I know there's no document there because I didn't create one. As soon as I add document with the name "moscow" to the "cities" collection the error disappears. Instead I get a message either saying read allowed or not. It's just a confusing and not very descriptive error. Thanks you for the answer!
    – manidos
    Sep 21, 2018 at 6:14
  • Ah. I see. While there may no document at that location, the bigger picture for the rules issue was that the fields trying to read are not present in any of the locations. I think my answer identifies the issue and provides a solution as well. If it helped, please accept it so it can help others!
    – Jay
    Sep 21, 2018 at 14:05
6

A bit more explanation would have made manidos's answer a good one.

It seems like resources should be used only for rules involving data that have been already written; e.g. delete, read, update, etc.

If you want to set rules on data that "will be" written, use getAfter.

1
  • If you're writing you can access the data you're going to write via request.resource
    – teone
    Aug 14, 2020 at 22:25
5

The issue is - as manidos - pointed out that the document /cities/moscow doesn't exist and hence the document is not accessible. However, a cleaner way to specify your rule is:

allow read: if (resource == null) || (resource.data.visibility == 'public')

It allows an application to query data that doesn't exist without blowing up with a security exception.

3

The key is to reading through the comments.

Many apps store access control information as fields on documents in the database. Cloud Firestore Security Rules can dynamically allow or deny access based on document data:

and then

// Allow the user to read data if the document has the 'visibility' field set to 'public'

If you look at the example data provided in the guide

let citiesRef = db.collection("cities")
citiesRef.document("SF").setData([
    "name": "San Francisco",
    "state": "CA",
    "country": "USA",
    "capital": false,
    "population": 860000,
    "regions": ["west_coast", "norcal"]
])

There is no 'visibility' field, however there is a name, state country field etc.

If you want to work with that data set, add a 'visibility' field to each city and set it's value to 'public'

 citiesRef.document("SF").setData([
        "name": "San Francisco",
        "visibility": "public"
0

I'm still learning but the issue with

allow read: if (resource == null) || (resource.data.visibility == 'public')

is when you use such a rule for /cities/{doc}. From what i can see resource == null whenever you search for documents without an exact document ID; the above rule would show everything, private and public, for /cities/{doc} because resource always == null.

From what i've been able to piece together one must make use of the get(...) statement to directly access a document's data whenever within a match that can return 1 or more documents, so

get(/database/...).data.visibility == 'public'

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.