Firestore - 权限缺失或不足

Question

我正在尝试对我的 Firestore 执行查询。

当使用相同的正文和 URL 从 PostMan 执行查询时，它可以工作，并且我得到了结果。当我使用 RESTSharp 从 C# 执行查询时，出现“禁止”错误。

我的身体：

{
    "structuredQuery": {
        "where": {
            "fieldFilter": {
                "field": {
                    "fieldPath": "thing_id"
                },
                "op": "EQUAL",
                "value": {
                    "stringValue": "thing-123456"
                }
            }
        },
        "from": [
            {
                "collectionId": "thing"
            }
        ]
    }
}

使用的网址是：https://firestore.googleapis.com/v1beta1/projects/myProject/databases/(default)/documents:runQuery

我的 C# 调用：

public async Task<string> Post<TRequest>(string path, TRequest body, string bearerToken = "", string apiKey = "")
        {
            try
            {
                var url = new Uri(_baseUrl, path);
                var client = new RestClient(url);
                var restRequest = new RestRequest(Method.POST);

                if (!string.IsNullOrEmpty(bearerToken))
                {
                    client.AddDefaultHeader("Authorization", string.Format($"Bearer {bearerToken}"));
                }

                if (!string.IsNullOrEmpty(apiKey))
                {
                    client.Authenticator = new HttpBasicAuthenticator("api-key", apiKey);
                    restRequest.AddHeader("api-key", apiKey);
                }


                restRequest.AddHeader("Accept", "*/*");
                restRequest.AddHeader("Accept-Encoding", "gzip, deflate, br");
                restRequest.AddHeader("Connection", "keep-alive");


                restRequest.AddJsonBody(body);
                restRequest.OnBeforeDeserialization = resp => { resp.ContentType = "application/json"; };

                Log.Information("Performing POST to {Url}", url);
                Log.Information("Body : {@Body}, Request : {@Request}", body, restRequest);

                var response = await client.ExecuteAsync(restRequest);
                Log.Information("{Url} received response with code {StatusCode}", url, response.StatusCode);
                if (response.IsSuccessful)
                {
                    return response.Content;
                }

                var errors = JsonConvert.DeserializeObject<List<ErrorRoot>>(response.Content);
                var messages = string.Join(",", errors.Select(e => e.error.message));
                throw new Exception(messages);
            }
            catch (Exception ex)
            {
                throw ex;
            }
        }

在这两种情况下（C# 和 PostMan），我既不提供 API 密钥也不提供 BearerToken。在 FireBase 上，我关闭了所有规则：

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /{document=**} {
      allow read, write: if
          true
    }
  }
}