Do Firestore subdocuments inherit any permissions from parent documents?

user_1350796 0
Viewed 48

E.g. I have a document parentDoc with a collection subDocs and a childDoc that is part of that subDocs collection. If a user does not have permission to read the parentDoc, will they also be unable to read the childDoc?

firebase-security google-cloud-firestore firebase
2 Answers

If by "permissions" you mean "security rules", that is correct. The default for security rules is users do NOT have access.

user_24347840

Yes and No, this is highly dependant on your rules themselves and if you are using wild cards. As a rule of thumb, all requests are denied by default and must match a valid Security Rule to read from that location, these rules then cascade down from top to bottom and cannot override a previous directory.

for example:

service cloud.firestore {
  match /databases/{database}/documents {
    match /myDocument/ {
      // this targets a document named "myDocument"
      // this WILL be in effect as no rule above applies to this location
      match /posts/{moreDocuments} {
        // this targets all documents under a collection called "posts"
        // this WILL override the above rule on documents that follow this path
        // as no wild card above exists to conflict with this location
      }
    }
    match /{document=**} {
      // this uses a wild card that applies to ALL children documents as a default
      // this will override any following Security Rules
    }
    match /otherDocument/ {
      // this targets a document named "otherDocument
      // this will NOT be in effect as the rule above applies to this location
    }
  }
}
user_23011610
Related