Firestore规则中的子收集资源变量
我在Firestore中有一个任务集合。 任务具有标题为子任务的子汇编。任务和子任务都有一个所有者字段。 我有以下规则：
rules_version = '2';
service cloud.firestore {
match /databases/{database}/documents {
function isSignedIn() {
return request.auth != null;
}
match /tasks/{task} {
allow read, update, delete: if isSignedIn() && request.auth.uid == resource.data.owner;
allow create: if isSignedIn();
match /subtasks/{subtask} {
allow read, write: if isSignedIn() && request.auth.uid == resource.data.owner;
}
}
}
}
匹配/tasks/{task}使用resource.data.data.owner检查auth uid的预期工作。为了避免额外的get（）充电，我也将所有者存储在子任务中。
为什么request.auth.uid == resource.data.outher投掷firebaseError：丢失或不足的权限。尝试检索子任务时？？
编辑： 参考我如何查询文档也可能很重要：
const subtasksSnapshot = await getDocs(collection(db, "tasks/" + taskId + "/subtasks"));
subtasksSnapshot.forEach((subtask) => {
console.log(subtask.data());
});
I have a tasks collection in firestore. Tasks have subcollections titled subtasks. Both tasks and subtasks have an owner field.
I have the following Rules:
rules_version = '2';
service cloud.firestore {
match /databases/{database}/documents {
function isSignedIn() {
return request.auth != null;
}
match /tasks/{task} {
allow read, update, delete: if isSignedIn() && request.auth.uid == resource.data.owner;
allow create: if isSignedIn();
match /subtasks/{subtask} {
allow read, write: if isSignedIn() && request.auth.uid == resource.data.owner;
}
}
}
}
The match /tasks/{task} works as expected with checking the auth uid against resource.data.owner. To avoid an extra get() charge I am storing the owner on the subtasks as well.
Why does request.auth.uid == resource.data.owner throw FirebaseError: Missing or insufficient permissions. when attempting to retrieve a subtask?
Edit:
It also might be of important to reference how I am querying documents:
const subtasksSnapshot = await getDocs(collection(db, "tasks/" + taskId + "/subtasks"));
subtasksSnapshot.forEach((subtask) => {
console.log(subtask.data());
});
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
运行上述查询时，它还包括
所有者不是当前用户的文档。安全规则不会过滤数据。您必须自己滤除具有给定约束的文档。尝试运行以下查询：另外，请确保在运行查询之前登录用户。
When you run the above query, it also includes documents where
owneris not current user. Security rules do not filter out data. You must filter out documents with given constraints yourself. Try running the following query:Additionally, do ensure that user is logged in before running the query.