I am trying to allow read/write to only a users UID, however script keeps saying missing permission please help.
Many thanks`
service cloud.firestore {
match /databases/{database}/documents {
match /users/{userId} {
allow read, update, delete: if request.auth.uid == userId;
allow create: if request.auth.uid == userId;
}
}
}
db.collection('users').doc(userId).collection('details').add(...
The rules you've written only match documents that are immediately within the collection called "users". However, you're trying to access a document within a subcollection of a document of under "users".
The documentation addresses this situation very specifically, so be sure to read and understand how hierarchical data works for security rules.
If you want to apply per-user rules to all documents in a collection, and all the documents in all nested subcollections under that document, you can simply say this:
service cloud.firestore {
match /databases/{database}/documents {
match /users/{userId} {
allow read: if request.auth.uid == userId;
match /{document=**} {
allow read: if request.auth.uid == userId;
}
}
}
}
Note that the match has to be nested like this in order it to use the userId wildcard from the outer match.
Probably your forgot to enable sign-in provider in the firebase console.
Related
My security rules are super simple. I have two collections - riders and races:
riders: can only be read from or written to when the user is signed in
races: can be read from by unauthenticated user; written to when user is signed in.
service cloud.firestore {
match /databases/{database}/documents {
// restrict read/write on all to authenticated
match /{document=**} {
allow read, write: if request.auth != null;
// then allow collection read if match
match /races/{id} {
allow read, list: if true;
}
}
}
}
These rules allow what appears to be the correct setup using the Firebase consoles Rules Playground but in the browser auth users behave as expected but the unauthed users are returned an error when making a call for a race:
core.js:6456 ERROR FirebaseError: Missing or insufficient permissions.
at new e (prebuilt-47338342-439a2133.js:188)
at prebuilt-47338342-439a2133.js:10415
at prebuilt-47338342-439a2133.js:10416
at e.onMessage (prebuilt-47338342-439a2133.js:10438)
at prebuilt-47338342-439a2133.js:10355
at prebuilt-47338342-439a2133.js:10386
at prebuilt-47338342-439a2133.js:15146
at ZoneDelegate.invoke (zone.js:372)
at Zone.run (zone.js:134)
at zone.js:1276
// service call
this.racesCollection = this.firestore.collection<Race>('races');
this.racesCollection
.doc(id)
.valueChanges()
.pipe(takeUntil(this.destroy$))
.subscribe((response: any) => {
console.log('=== APP SERVICE emits race ===', response);
this.race.next(response);
});
I've tried rewriting the rules but cannot seem to find my way around this one. Any help or ideas appreciated! Thanks.
You should write your security rules in such a way they overlap:
service cloud.firestore {
match /databases/{database}/documents {
// restrict read/write on all to authenticated
match /{document=**} {
allow read, write: if request.auth != null;
}
// then allow read for the races collection for all users
match /races/{id} {
allow read, list: if true;
}
}
}
In addition, note that list is a "sub-case" of read, so you might remove the list rule, i.e. just do allow read: if true;.
BTW, the simulator does correctly show that your rules do not allow reading a document in the races collection if you are not authenticated.
For context, I display my Firebase app's configuration in the app.js file (is this safe?) and in order to give a user their data I list the following code:
db.collection('whispers').where("sender", "array-contains",
userID).orderBy('time').onSnapshot(snapshot => {
let changes = snapshot.docChanges();
changes.forEach(change => {
renderSay(change.doc);
});
});
Could a user remove the 'where' condition and access all data in this collection? I only use anonymous sign in so nothing special required in accessing their own data besides using the same device and not clearing data.
I doubt that could be possible by reverse-engineering but the actual security lies in the security rules.
You can change them from the Firebase Console
Here is a video from Firebase and here is the documentation
service cloud.firestore {
match /databases/{database}/documents {
// Match any document in the 'users' collection
match /users/{userID} {
allow read: if request.auth.uid === userID;
allow write: if request.auth.uid === userID;
}
}
}
Using the above security rules will allow users to read and write their data ONLY.
So even if they reverse-engineer your code, it will harm their data only and other data will be safe.
For more details please check the links above and you will get familiar with wildcard [{userID} in this case]
PS: Only you or anyone with access to your Firebase Console can change the rules
EDIT: This Medium Article has many types of rules explained. Please have a read there too :D
I'm having what I think maybe a simple issue with Firebase Rules, but I can't seem to get this to work. I have a document 'Companies', with multiple subcollections inside. I want to set up a rule that checks for admins in an array (with each array item being a string of the firebase userId) inside a 'company' document and allows them to read/write all subcollections of that document.
Here's the data structure in a single company document:
company1 {
admins: ["userid1", "userid2", "userid3"],
}
Here's my firebase rule:
rules_version = '2';
service cloud.firestore {
match /databases/{database}/documents {
match /companies/{company}/{document=**} {
allow read, write: if request.auth.uid in get(/databases/$(database)/documents/companies/$(company)).data.admins
}
}
}
Here's an example of a query that's not working when it should:
let ref = db.collection("companies");
//get current users company
ref
.where("admins", "array-contains", firebase.auth().currentUser.uid)
.get()
.then((snapshot) => {
snapshot.forEach((doc) => {
this.company = doc.data();
this.company.id = doc.id;
});
});
I hope my question makes sense :)
I found an answer, I hope it helps anyone who might come upon this.
I ended up adjusting the data structure to include the company document ID as a field in the user doc. Then, I created these rules to allow users to read/write their own user doc based on firebase authentication, as well as read/write their companies based on a field in the user doc:
service cloud.firestore {
match /databases/{database}/documents {
// Allow users to create and edit the document for themselves in the users collection
match /users/{user} {
allow read, write: if request.auth.uid == user;
}
// Allow users to create a company for themselves upon signup
match /companies/{company} {
allow create: if request.auth.uid != null
}
match /companies/{company}/{document=**} {
// Allow users to read/write data on thier own companies
allow read, write: if company in get(/databases/$(database)/documents/users/$(request.auth.uid)).data.companies
}
}
}
I have the following rules set up for my Firestore database:
rules_version = '2';
service cloud.firestore {
match /databases/{database}/documents {
match /collections/{document=**} {
allow read;
allow write: if isAdmin();
}
match /general/{document=**} {
allow read;
allow write: if isAdmin();
}
match /inquiries/{document=**} {
allow write;
allow read: if isAdmin();
}
match /orders/{document=**} {
allow write;
allow read: if isAdmin() || resource.data.userID == request.auth.uid;
}
match /products/{document=**} {
allow read;
allow write: if isAdmin();
}
match /users/{userId} {
allow write, read: if belongsTo(userId);
}
function belongsTo(userId) {
return request.auth.uid == userId
}
function isAdmin() {
return resource.data.admin == true;
}
}
}
As you can see, everybody is allowed to read /products and its documents plus subcollections. Which works for the products, but somehow the product's subcollection (every product has one called collection-colors) can't be read.
FirebaseError: Missing or insufficient permissions.
Code causing the error:
retrieveCollectionColors(name) {
this.db.collectionGroup('collection-colors', ref => ref.where('product', '==', name))
.valueChanges().subscribe( (val: []) => {
this.collectionColors.next(val);
}, error => {
console.log(error);
});
}
The rules you have right now don't apply at all to collection group queries. You'll need to write a special rule for that. From the documentation:
Secure and query documents based on collection groups
In your security rules, you must explicitly allow collection group
queries by writing a rule for the collection group:
Make sure rules_version = '2'; is the first line of your ruleset. Collection group queries require the new recursive wildcard {name=**}
behavior of security rules version 2.
Write a rule for you collection group using match /{path=**}/[COLLECTION_ID]/{doc}.
So, if you want to allow collection group queries for "collection-colors", it will look something like this:
match /{path=**}/collection-colors/{doc} {
allow read: ...
}
This will apply to all subcollections with the given name. You can't selectively allow or disallow subcollections based on the name of the parent collection.
When a user is created I need to add some additional data about the user (e.g. name).
So I need a publicly writable collection. However I've tried adding create and update (I think that's for set and add respectively), but I'm still getting "Error: Missing or insufficient permissions." when trying to do:
db.collection('newUsers').add({
firstName,
lastName,
});
With this rule:
service cloud.firestore {
match /databases/{database}/documents {
match /newUsers {
allow create, update;
}
}
}
How can I add an entry to that collection without being authed?
service cloud.firestore {
match /databases/{database}/documents {
match /newUsers/{user} {
allow create, update if true;
}
}
}
Note that you need to match an actual document, not just a collection. The wildcard {user} should do this.