Firestore: Query a collection for all documents user has access to

user_7005395 0
Viewed 485

Running into a situation that I'm unclear has a clean solution.

In Firestore, I have a collection in which user are only allowed to access certain documents. Users can be assigned to one or more accounts, and Accounts can have one or more user. The general models and rules work as expected:

USER: {
  id       : abc123,
  accounts : [ xyz789, ... ]
}

ACCOUNT: {
  id      : xyz789,
  users   : [ abc123, ... ]
}

service cloud.firestore {
  match /databases/{database}/documents {
    match /accounts/{accountID} {
      allow read, write: if accountID in get(/databases/$(database)/documents/users/$(request.auth.uid)).data.accounts;
    }
  }
}

From what I can tell with the Firebase Rule Simulator, the above rule is working correctly (I can read/update the accounts that list my userID, but not the ones that don't).

The issue is that if I want to get those same accounts via a Query operator, I get an error. The error does go away when I relax the ruleset, but that's not ideal.

firestore.collection('accounts').where('users', 'array-contains', userID)

ERROR: Missing or insufficient permissions

Given that the ruleset and the query seem to refer to the same records, is there a way to get them to work in conjunction or am I forced to relax the rules in order to get this to work?

google-cloud-firestore firebase
1 Answers

I had a similar problem before and I found that Firebase doesn't check the fetched data to validate the rules, but it compare the query code with the rules, and depending on that it throws the exception

So what I found is that the if condition should have a where filter in the code

This if condition is missing a where

allow read, write: if accountID in ...

To make your code work, it would need to add a where filter that refers to accountID

firestore().collection('accounts')
    .where(firestore.FieldPath.documentId(), 'in', accounts) //accounts: ['xyz789']
    .where('users', 'array-contains', userID)
user_45087580
Related