Security rules causes always getting "Permission denied"

1
votes

I feel like there is something wrong with Firebase 3 Security Rules.

My rules look like this:

{"rules":
  {
    "pages": {
      ".read": true,
      "$pageId": {
        ".read": true,
        ".write": "root.child('adminUsers').hasChild(auth.uid)"
      }
    },
    "adminUsers": {
      ".read": false,
      ".write": false
    }
  }
}

Trying to add set a page object 

firebase.database().ref('/pages/-KL1TmkWWNUYsMqvTw1E').set({slug: 'rule'})

Got this error (even though /adminUsers/-XXXX = true where -XXXX is my user id):

FIREBASE WARNING: set at /pages/-KL1TmkWWNUYsMqvTw1E failed: permission_denied

After changing ".write": "root.child('adminUsers').hasChild(auth.uid)" to ".write": true, it worked. But that's not what I wanted.

Tested the same thing with Rules simulator, everything's ok. I'm lost.

1
firebasefirebase-realtime-databasefirebase-security
Can you show us some data of your tree so we can see exactly how it is structured? You have an export to JSON option on the database tab to make it easy. - adolfosrs

1 Answers

0
votes

Thanks @adolfosrs for asking me to export the db to JSON

I found that I wrap the userId with quotes, and it caused the problem

{
  "adminUsers" : {
    "\"9hIokhGbBDfcvdQAPIoM7QcDS3g5\"" : true
  },
  "pages" : {
    "-KL1TmkWWNUYsMqvTw1E" : {
      "slug" : "xxx"
    }
  }
}