Question

我正在尝试为我的Firestore数据库创建一些规则。当我在Firebase控制台的模拟器中运行这些规则时，一切正常。但是，当我部署规则并在我的网站上试用时，控制台中出现了权限被拒绝的错误。

我要访问的数据存储如下：

1。 / teams / {teamId}

2。 / teams / {teamId} / boards / {boardId}

其中{teamId}和{boardId}是自动生成的ID：

例如：

/ teams / JTUrZcqz9Z20JuyCCcnV

/ teams / JTUrZcqz9Z20JuyCCcnV / boards / OfcLPZItCk6Li7OeXwwt

我正在尝试遍历所有这些孩子。

Firestore数据库：

firestore.rules：

 match /teams/{teamId} {
   allow read: if isMemberOfTeam(teamId);
   allow write: if true; // memberOfTeam(teamId);

  match /boards/{boardID} {
   allow read: if memberOfTeam(teamId) || boardIsPublic(teamId);
   allow write: if memberOfTeam(teamId);

    match /{document=**} {
     allow read: if memberOfTeam(teamId) || boardIsPublic(teamId);
     allow write: if memberOfTeam(teamId);
     }
  }
  match /{document=**} {
   allow read: if isMemberOfTeam(teamId); // memberOfTeam(teamId);
   allow write: if true; // memberOfTeam(teamId);
  }
 }

function isMemberOfTeam(teamId) {
    return  get(/databases/$(database)/documents/teams/$(teamId)).members[request.auth.uid].isMember;
}
function boardIsPublic(teamId) {
    return get(/databases/$(database)/documents/teams/$(teamId)).data.isPublic;
}

网站代码： Firestore查询：

ref.where('members.' + user.uid + '.isMember', '==', true)

所有代码：

this.teamsCollection = this.auth.user$.filter(user => user != null)
  .map(user => this.afs.collection<TeamsInterface>('teams', ref => ref.where('members.' + user.uid + '.isMember', '==', true)))
  .shareReplay(1);
this.$teams = this.teamsCollection.switchMap(collection => collection.snapshotChanges().map(actions => {
  return actions.map(a => {
    const data = a.payload.doc.data() as TeamsInterface;
    data.id = a.payload.doc.id;
    return data;
  });
}));

我进入控制台错误：

权限不足或权限不足。

Answer 1

我不知道为什么，但是所有代码都可以使用此代码：

match /teams/{teamId} {
      allow read: if isMemberOfTeam(existingData());
      allow update: if isMemberOfTeam(existingData()); // memberOfTeam(teamId);
      allow create: if isSignedIn();

      match /archived/{boardID} {
        allow read: if isMemberOfTeam(get(/databases/$(database)/documents/teams/$(teamId)).data) 
              || boardIsPublic(existingData());
        allow write: if isMemberOfTeam(get(/databases/$(database)/documents/teams/$(teamId)).data);
      }

      match /boards/{boardID} {
        allow read: if isMemberOfTeam(get(/databases/$(database)/documents/teams/$(teamId)).data) 
              || boardIsPublic(existingData());
        allow write: if isMemberOfTeam(get(/databases/$(database)/documents/teams/$(teamId)).data);

        // match /beta {
        //   allow write: if memberOfTeam(teamId) || boardIsPublic(teamId);
        // }

        // All subcollection
        match /{document=**} {
          allow read: if isMemberOfTeam(get(/databases/$(database)/documents/teams/$(teamId)).data) 
                || boardIsPublic(get(/databases/$(database)/documents/teams/$(teamId)).data);
          allow write: if isMemberOfTeam(get(/databases/$(database)/documents/teams/$(teamId)).data);
         }
      }

     }

Firestore规则可在模拟器中使用，但不能在网站上使用

1 个答案: