如何使用安全规则对Firestore的公共收藏进行查询？

Question

我在以这种方式定义的Firestore安全规则中有一个规则集：

rules_version = '2';
service cloud.firestore {

  match /databases/{database}/documents {
    function isUserAllowed(root, metric) {
      return metric != 'private-data' || (metric == 'private-data' && request.auth.token.sub in get(/databases/$(database)/documents/$(root)/users).data.users);
    }
    
    match /{root}/{doc} {
      allow read:  if root != 'ispd' && doc != 'users';
      allow write: if false;

      match /{metric}/{docs=**} {
        allow read: if isUserAllowed(root, metric);
        allow write: if false;
      }
    }
  }
}

我正在尝试从React应用程序中执行此方法，

const checkForbiddenEmailDomain = (emailDomain) => {
  const collectionRef = collection(db, 'forbidden-domains');

  const q = query(collectionRef, where('domain', '==', emailDomain));

  return getDocs(q)
    .then(({ docs }) => {
      if (docs.length > 0) {
        const errorToThrown = { message: `The ${emailDomain} domain is forbidden` };
        throw errorToThrown;
      }
    });
};

因为我正在访问禁止域公共的我不应该遇到问题，但是，我总是会遇到丢失或不足的权限。我知道Firestore文档中有一部分，他们说诸如“规则不是查询，Blablabla”之类的东西，埃及象形文字可能更简单地理解

Answer 1

我终于以这种方式修改了MU规则集，它有效：

rules_version = '2';
service cloud.firestore {

  match /databases/{database}/documents {
    function isUserAllowed(root, metric) {
      return metric != 'private-data' || (metric == 'private-data' && request.auth.token.sub in get(/databases/$(database)/documents/$(root)/users).data.users);
    }
    
    match /forbidden-domains/{docs=**} {
        allow read;
      allow write: if false;
    }
    
    match /{root}/{doc} {
      allow read: if root != 'instagram-service-private-data' && doc != 'users';
      allow write: if false;

      match /{metric}/{docs=**} {
        allow read: if isUserAllowed(root, metric);
        allow write: if false;
      }
    }
  }
}