Cfrgtkky

Question:

For the different top-level firestore collections below, how to restrict access to all but one of the paths?

We are building a data schema in Firestore to support a chat app for teachers across multiple schools.

The top-level firestore collections include:

• /siteAdminUsers


• /schools


• /schools/{schoolId}/teachers


• /schools/{schoolId}/chats

Below is the security rules setup we are trying now - where we check for:

1. valid user auth


2. expected value exists in userClaim variable request.auth.token.chatFlatList
   

However, the read listener for /messages is being blocked.

Error message:

FirebaseError: [code=permission-denied]: Missing or insufficient permissions

service cloud.firestore {

  match /databases/{database}/documents {



    match /{document=**} {

      allow read, write: if false;

    }



    match /schools/{schoolId}/chats/{discussionId}/messages {

      allow write: if false;

      allow read: if request.auth != null

                  && request.auth.token != null

                  && request.auth.token.chatFlatList.val().contains($discussionId);

    }

}

Details

We are using cloud functions for all data read/write, so for almost every case we can just block all client access.

The one exception is for the chat discussions, where we need to set a snapshot listener in the mobile client to know when there are new messages.

Sub-collection notes:

At a school, there are discussion sessions for school staff (teachers, admins, etc)

/schools/{schoolId}/chats/{discussionId}

Where each discussion-document contains:

1. list of participant teacher ids


2. subcollection for actual messages where each document is an indivual posted message:

/schools/{schoolId}/chats/{discussionId}/messages

User Claim code from Cloud Function

Looking at the cloud function logs, we have verified that the userClaim is being set.

return firebaseAdmin

    .auth()

    .setCustomUserClaims(

        uid, {

            chatFlatList: 'id1 id2 id3'

        }

    );

UPDATE #1

Tried the following variation where rules skip/omit the check on userClaim and auth.token.

However, still same permission error.

service cloud.firestore {

  match /databases/{database}/documents {



        match /{document=**} {

          allow read, write: if false;

        }



        match /schools/{schoolId}/chats/{discussionId}/messages {

          allow write: if false;

          allow read: if request.auth != null;

        }



    }

}