Firebase GET request blocked by simple firebase rules

1110 0
Viewed 20

I have the following collection group query:

const userInRooms = await firestore()
        .collectionGroup('userRooms')
        .where('uid', '==', authenticatedUser.uid)
        .get();

And it works fine. But since I added security rule:

match /rooms/{docId} {
      allow read;
      allow write;
      match /userRooms/{docId} {
        allow read;
        allow write;
      }
    }

userRooms is subcollection in rooms.
It stopped working and I getting:

NativeFirebaseError: [firestore/permission-denied] The caller does not have permission to execute the specified operation.

firebase-security google-cloud-firestore javascript
1 Answers

Cascading the sub-collections rules that way doesn't work for collection group queries. A recursive wildcard must be present at the beginning of the path so it'll match any collections with that name. Try:

match /rooms/{docId} {
  //...
}

match /{path=**}/userRooms/{docId} {
  allow read, write: if true;
}

Do change the rules as required instead of allowing everyone to read the database (unless they are allowed to).

Dharmaraj0
Related