How this Firebase security rule, based on custom claims, billed against my Firestore quota?

user_3370568 0
Viewed 35

From the Firebase Security Rules docs,

Remember that any time your rules include a read, like the rules below, you're billed for a read operation in Cloud Firestore.

service cloud.firestore {
 match /databases/{database}/documents {
   // For attribute-based access control, check for an admin claim
   allow write: if request.auth.token.admin == true;
   allow read: true;

   // Alterntatively, for role-based access, assign specific roles to users
   match /some_collection/{document} {
    allow read: if request.auth.token.reader == "true";
    allow write: if request.auth.token.writer == "true";
  }
 }
}

But I couldn't see any Firestore get operations like get(/databases/$(database)/documents/users/$(request.auth.uid)). So how this above rule is billed against firestore?

enter image description here

firebase-security google-cloud-firestore firebase
1 Answers

You are right: The rules in your question, which check custom claims, don’t incur Firestore reads.

It is most probably a copy/paste error in the documentation: If you look at the doc page, the block above the one you pasted in your question has the exact same sentence (and this time this sentence correctly applies to the code example, which includes the get() function).

(FYI I’ve used the feedback button at the bottom of the doc page to report the problem to the Firebase team)

user_33718620
Related