Firestore安全规则:仅允许读取作者规则不起作用

发布于 2025-01-21 22:46:30 字数 1864 浏览 3 评论 0原文

我正在尝试使用availability状态来保护我的文档,这可以是publicprivate。每个人都可以读取public文档和private文档可以由创建文档的用户读取(含义createoruid设置为用户的UID)。

这些是我的规则:

match /Routines/{document} {      
    allow read: if resource.data.availability == "public" ||  (resource.data.availability == "private" && resource.data.creatorUid == request.auth.uid);
    allow write: if true;
}

我创建了一些测试以查看我的规则是否有效:

describe.only("Routine Routine Rules", () => {

    const userAuthA = { uid: "user123", email: "[email protected]" };

    const demoRoutinePrivate = {
        id: "DemoRoutine",
        title: "Demo Routine",
        availability: "private",
        creatorUid: userAuthA.uid,
        exercises: []
    }

    it("Authors can read private routines", async () => {
        const admin = getAdminFirestore();
        await admin.collection("Routines").doc(demoRoutinePrivate.id).set(demoRoutinePrivate);

        const db1 = getAuthedFirestore(userAuthA);
        const routines1 = db1.collection("Routines").where("creatorUid", "==", userAuthA.uid);
        const routine1 = db1.collection("Routines").doc(demoRoutinePrivate.id);
        await firebase.assertSucceeds(routines1.get());
        await firebase.assertSucceeds(routine1.get());
    });
});

但是,我会遇到此错误:

FirebaseError: 
Property availability is undefined on object. for 'list' @ L33

我可以肯定我的文档具有availabilty属性集,所以我不了解错误。

编辑:这是文档的筛查: ”在此处输入图像描述

I'm trying to secure my Documents with a availability status, that can be public or private. Everybody can read public Documents and private Documents can be read by Users who have created the Document (meaning creatorUid is set to the user's uid).

These are my rules:

match /Routines/{document} {      
    allow read: if resource.data.availability == "public" ||  (resource.data.availability == "private" && resource.data.creatorUid == request.auth.uid);
    allow write: if true;
}

I have created some tests to see if my rules work:

describe.only("Routine Routine Rules", () => {

    const userAuthA = { uid: "user123", email: "[email protected]" };

    const demoRoutinePrivate = {
        id: "DemoRoutine",
        title: "Demo Routine",
        availability: "private",
        creatorUid: userAuthA.uid,
        exercises: []
    }

    it("Authors can read private routines", async () => {
        const admin = getAdminFirestore();
        await admin.collection("Routines").doc(demoRoutinePrivate.id).set(demoRoutinePrivate);

        const db1 = getAuthedFirestore(userAuthA);
        const routines1 = db1.collection("Routines").where("creatorUid", "==", userAuthA.uid);
        const routine1 = db1.collection("Routines").doc(demoRoutinePrivate.id);
        await firebase.assertSucceeds(routines1.get());
        await firebase.assertSucceeds(routine1.get());
    });
});

However, I get this error:

FirebaseError: 
Property availability is undefined on object. for 'list' @ L33

I'm pretty certain that my Document has the availabilty property set, so I don't understand the error.

EDIT: here is the screenshot of the document: enter image description here

如果你对这篇内容有疑问,欢迎到本站社区发帖提问 参与讨论,获取更多帮助,或者扫码二维码加入 Web 技术交流群。

扫码二维码加入Web技术交流群

发布评论

需要 登录 才能够评论, 你可以免费 注册 一个本站的账号。

评论(1

情泪▽动烟 2025-01-28 22:46:30

我发现了。我的查询错误。

const routines1 = db1.collection("Routines").where("creatorUid", "==", userAuthA.uid);

正确的查询是:

const routines1 = db1.collection("Routines").where("availability", "==", "private").where("creatorUid", "==", userAuthA.uid);

尽管原始错误消息不是很有帮助...

I figured it out. I had an error in my query.

const routines1 = db1.collection("Routines").where("creatorUid", "==", userAuthA.uid);

the correct query is:

const routines1 = db1.collection("Routines").where("availability", "==", "private").where("creatorUid", "==", userAuthA.uid);

although the original error message is not very helpful...

~没有更多了~
我们使用 Cookies 和其他技术来定制您的体验包括您的登录状态等。通过阅读我们的 隐私政策 了解更多相关信息。 单击 接受 或继续使用网站,即表示您同意使用 Cookies 和您的相关数据。
原文