Question

我正在Flutter中编写我的第一个应用程序，并被Firestore安全规则所困。我可以允许读写操作，并且一切正常，但是如果我想限制向拥有帐户的用户添加对象，事情就会中断。

更具体地说，我有以下规则：

    match /ratings/{anyRatingFile=**} {
      allow create: if request.auth.uid == get(/databases/$(database)/documents/$(request.resource.data.user)).id;
    }

基本上，如果请求中的用户ID存在，那么我将接受创建请求。我可以使用在线模拟器，并且可以使用！如果未注册UID，我将被拒绝，否则请求将被接受。但是，当我尝试在flutter应用程序中创建对象时，它始终会由于以下堆栈跟踪而崩溃：

W/Firestore(30727): (19.0.0) [Firestore]: Write failed at ratings/48MZwRY66G13g8T0Nl8j: Status{code=PERMISSION_DENIED, description=Missing or insufficient permissions., cause=null}
E/flutter (30727): [ERROR:flutter/lib/ui/ui_dart_state.cc(148)] Unhandled Exception: PlatformException(Error performing setData, PERMISSION_DENIED: Missing or insufficient permissions., null)
E/flutter (30727): #0      StandardMethodCodec.decodeEnvelope (package:flutter/src/services/message_codecs.dart:564:7)
E/flutter (30727): #1      MethodChannel.invokeMethod (package:flutter/src/services/platform_channel.dart:316:33)
E/flutter (30727): <asynchronous suspension>
E/flutter (30727): #2      DocumentReference.setData (package:cloud_firestore/src/document_reference.dart:51:30)
E/flutter (30727): #3      CollectionReference.add (package:cloud_firestore/src/collection_reference.dart:58:23)
E/flutter (30727): <asynchronous suspension>
E/flutter (30727): #4      MyApp.submitRating (package:MyApp/screens/myscreen.dart:128:16)
E/flutter (30727): #5      MyApp._buildMain.<anonymous closure> (package:MyApp/screens/myscreen.dart:93:24)
E/flutter (30727): #6      _InkResponseState._handleTap (package:flutter/src/material/ink_well.dart:635:14)
E/flutter (30727): #7      _InkResponseState.build.<anonymous closure> (package:flutter/src/material/ink_well.dart:711:32)
E/flutter (30727): #8      GestureRecognizer.invokeCallback (package:flutter/src/gestures/recognizer.dart:182:24)
E/flutter (30727): #9      TapGestureRecognizer._checkUp (package:flutter/src/gestures/tap.dart:365:11)
E/flutter (30727): #10     TapGestureRecognizer.handlePrimaryPointer (package:flutter/src/gestures/tap.dart:275:7)
E/flutter (30727): #11     PrimaryPointerGestureRecognizer.handleEvent (package:flutter/src/gestures/recognizer.dart:455:9)
E/flutter (30727): #12     PointerRouter._dispatch (package:flutter/src/gestures/pointer_router.dart:75:13)
E/flutter (30727): #13     PointerRouter.route (package:flutter/src/gestures/pointer_router.dart:102:11)
E/flutter (30727): #14     _WidgetsFlutterBinding&BindingBase&GestureBinding.handleEvent (package:flutter/src/gestures/binding.dart:218:19)
E/flutter (30727): #15     _WidgetsFlutterBinding&BindingBase&GestureBinding.dispatchEvent (package:flutter/src/gestures/binding.dart:198:22)
E/flutter (30727): #16     _WidgetsFlutterBinding&BindingBase&GestureBinding._handlePointerEvent (package:flutter/src/gestures/binding.dart:156:7)
E/flutter (30727): #17     _WidgetsFlutterBinding&BindingBase&GestureBinding._flushPointerEventQueue (package:flutter/src/gestures/binding.dart:102:7)
E/flutter (30727): #18     _WidgetsFlutterBinding&BindingBase&GestureBinding._handlePointerDataPacket (package:flutter/src/gestures/binding.dart:86:7)
E/flutter (30727): #19     _rootRunUnary (dart:async/zone.dart:1136:13)
E/flutter (30727): #20     _CustomZone.runUnary (dart:async/zone.dart:1029:19)
E/flutter (30727): #21     _CustomZone.runUnaryGuarded (dart:async/zone.dart:931:7)
E/flutter (30727): #22     _invoke1 (dart:ui/hooks.dart:250:10)
E/flutter (30727): #23     _dispatchPointerDataPacket (dart:ui/hooks.dart:159:5)

并且根据请求，代码如下：

  var collection = Firestore.instance.collection('ratings');

    collection.add({
      "puzzle": "/sample/" + ID,
      "user": "/users/" + appState.user.uid,
      "rating": rating,
    });

还有更多调试信息。 Firestore网站上的此请求有效，例如返回“允许模拟写入”。

{"__name__":"/databases/(default)/documents/ratings/test","id":"test","data":{"user":"/users/PCAE2"}}

身份验证有效载荷：

{
  "uid": "PCAE2",
  "token": {
    "sub": "PCAE2",
    "aud": "myApp-1",
    "email": "",
    "email_verified": false,
    "phone_number": "",
    "name": "",
    "firebase": {
      "sign_in_provider": "google.com"
    }
  }
}

为了匿名，我删去了大多数用户ID，但否则它是复制粘贴。在我的本地日志中，我看到以下消息：

W/BiChannelGoogleApi(30727): [FirebaseAuth: ] getGoogleApiForMethod() returned Gms: com.google.firebase.auth.api.internal.zzaq@9304ffb
D/FirebaseAuth(30727): Notifying id token listeners about user ( PCAE2 ).
I/flutter (30727): Logged in

有两个问题：

1）这是什么问题？

2）如何调试这种错误？我试图找到一些Firestore日志文件，但是找不到任何文件。我可以写单元测试，但是网站上的测试没有通过，因为它可以通过。

谢谢您的帮助！

Answer 1

我解决了我的特殊问题，但是我仍然不知道如何调试它。因此，如果您知道，请告诉我。

这里的问题是另一个规则：

match /users/{userId}/{anyUserFile=**} {
    allow read, write, delete: if request.auth.uid == userId
}

我的错误是我没有在问题中包括该错误，但是我认为这不会成为问题，因为模拟有效。无论如何，删除此行并允许世界上每个人对/ users /表进行读写都可以解决此问题。

这会打开一个新问题列表：

为什么仿真有效，但我的Flutter App请求却无效？
如何保护/ users /表？
如果模拟器与应用行为不同，将来如何调试类似的东西？

谢谢！

Answer 2

Firebase安全规则无法调试。但是，您当然可以通过simulator

验证规则

示例

如何在Flutter中调试Firestore安全规则

2 个答案: