firebase security - firestore.rules allow read of single document only - Stack Overflow

admin管理员组

文章数量:1316393

I'm building a webapp where users can create rooms and join rooms of others. My goal is for users to be able to retrieve any room they have the ID of, but only list rooms they are already a member of. (uid in room.participant_uids)

My firestore.rules so far succeed in restricting access based on participant.ids:

rules_version = '2';

service cloud.firestore {
  match /databases/{database}/documents {
    match /{document=**} {
      allow read, write: if false;
    }
    match /users/{uid} {
      allow read: if request.auth.uid == uid;
    }
    match /rooms/{id} {
      allow read: if request.auth.uid in resource.data.participant_uids;
    }
  }
}

However I would like another rule that allows reading of a document only when retrieving a single document by id.

I can solve this with a Firebase function if it is not possible, but I'd like to do without.

I'm building a webapp where users can create rooms and join rooms of others. My goal is for users to be able to retrieve any room they have the ID of, but only list rooms they are already a member of. (uid in room.participant_uids)

My firestore.rules so far succeed in restricting access based on participant.ids:

rules_version = '2';

service cloud.firestore {
  match /databases/{database}/documents {
    match /{document=**} {
      allow read, write: if false;
    }
    match /users/{uid} {
      allow read: if request.auth.uid == uid;
    }
    match /rooms/{id} {
      allow read: if request.auth.uid in resource.data.participant_uids;
    }
  }
}

However I would like another rule that allows reading of a document only when retrieving a single document by id.

I can solve this with a Firebase function if it is not possible, but I'd like to do without.

• google-cloud-firestore
• firebase-security

Share Improve this question Follow edited Jan 29 at 11:53 Daniel Eisenhardt asked Jan 29 at 10:26 Daniel EisenhardtDaniel Eisenhardt 59366 silver badges1414 bronze badges 1

• 1 You can use this Code where allow list: if request.auth.uid in resource.data.participant_uids; This rule restricts listing rooms to only those where the user is a participant. The list operation is used when querying a collection, which is mentioned in the Documentation. – Sandeep Vokkareni Commented Jan 29 at 12:19

Add a comment  | 

1 Answer 1

Sorted by: Reset to default 1

You can use get to specify a rule that applies to single document access. If you want anyone (authenticated or not) to be able to get a single "rooms" document:

match /rooms/{id} {
  allow get: true;
  allow read: if request.auth.uid in resource.data.participant_uids;
}

You may want to require authentication or some other requirements.

See the documentation for granular access for more details.

本文标签： firebase securityfirestorerules allow read of single document onlyStack Overflow