使用获得回报的Firestore规则不足
我正在使用以下查询来查询:
setDoc(doc(db, "vendors", this.vendorId), {
title: "test listing",
vendorId: this.vendorId
}, {merge: true}).then(i => {
console.log("i", i)
}).catch(e => {
console.log("error", e)
})
我有2个集合,第一个收藏品有一个sub Collection
收集用户/$ {userId}
{
"userId": "123.uuu",
"role": "vendor"
}
sub Collection用户/$ {userId}/vendors/$ {vendorid}
{
"user": "123.uuu",
"vendor": "123..vvv"
}
第二个集合是 收集供应商/$ {vendorid}
{
"userId": "123.uuu",
"role": "vendor"
}
我希望能够更新第二个集合供应商/$ {vendorid} ,但是只有当用户sub sub collection 用户/$ $ {userId}/vendors/$ {vendorid} 存在,因此可以访问它。
以下规则不起作用 - 返回 firbaseError:丢失或不足的权限。
match /vendors/{vendorId}{
allow update: if get(/databases/$(database)/documents/users/$(request.auth.uid)/vendors/$(vendorId)).data.user == request.auth.uid
}
I'm making a query to firestore using:
setDoc(doc(db, "vendors", this.vendorId), {
title: "test listing",
vendorId: this.vendorId
}, {merge: true}).then(i => {
console.log("i", i)
}).catch(e => {
console.log("error", e)
})
I have 2 collections the first one has a sub collection
Collection users/${userId}
{
"userId": "123.uuu",
"role": "vendor"
}
Sub collection users/${userId}/vendors/${vendorId}
{
"user": "123.uuu",
"vendor": "123..vvv"
}
The second collection is
Collection vendors/${vendorId}
{
"userId": "123.uuu",
"role": "vendor"
}
I want to be able to update the second collection vendors/${vendorId} but only if the users sub collection users/${userId}/vendors/${vendorId} exists and therefore has access to it.
The below rule doesn't work - returns FirebaseError: Missing or insufficient permissions.
match /vendors/{vendorId}{
allow update: if get(/databases/$(database)/documents/users/$(request.auth.uid)/vendors/$(vendorId)).data.user == request.auth.uid
}
如果你对这篇内容有疑问,欢迎到本站社区发帖提问 参与讨论,获取更多帮助,或者扫码二维码加入 Web 技术交流群。

绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱,如果其他用户或者作者回复了您的评论,将不能在第一时间通知您!
发布评论
评论(2)
允许更新
将允许更新操作,即文档必须已经存在。由于您正在使用setDoc()
,因此这意味着如果不存在,将创建一个新文档。尝试允许创建
也要:结帐关于安全规则,此外,此 firecast
The
allow update
will allow update operations only i.e. the document must already exist. Since you are using usingsetDoc()
, that means a new document is being created if it doesn't exist already. Try allowingcreate
as well:Checkout the documentation on Security Rules and also this Firecast
根据@Doug Stevenson的说法:“安全规则没有任何意义,除非与制作查询的代码配对。”,您可以尝试按照在我的终点复制的示例代码遵循示例代码:
此外,遵循@dharmaraj的答案。 ,您可以尝试以下规则:
有关更多信息,可以查看下面的指南:
如何修复firestore错误:currisermission_denied:丢失或不足的权限
According to @Doug Stevenson: "Security rules don't mean anything unless paired with code that makes the query.", you can try to follow the example code below that works upon replicating on my end:
Additionally, following the answer of @Dharmaraj, you can try this rule:
For more information, you can check the guide below:
How to fix Firestore Error: PERMISSION_DENIED: Missing or insufficient permissions