Multiple .get() calls in Firestore Security Rules

Question

I am developing the Firestore security rules for medical history app. I want staff and patients to be stored in separate collections to ensure HIPAA compliance (eg human resources or call center staff shouldn't be able to see clinical records). A patient belongs to a group which determines what products they have available to them. Patients shouldn't be able to see products from other groups. Staff need to have a privilege to see any products.

Data looks like this:

patient : {
    groupId: 1
}

product : {
    groupId: 1
}

staff: {
    canReadProducts: true
}

This rule works to allow a patient to read a product document:

match /products/{productId} {
    allow read: if get(.../patients/$(request.auth.uid))
                   .data.groupId == resource.data.groupId
}

This rule works to allow a staff member to read a product document:

match /products/{productId} {
    allow read: if get(.../staff/$(request.auth.uid))
                   .data.canReadProducts == true;
}

This rule does not work:

match /products/{productId} {
    allow read: if get(.../patients/$(request.auth.uid))
                   .data.groupId == resource.data.groupId
                || get(.../staff/$(request.auth.uid))
                   .data.canReadProducts == true;
}

These are simplified for the sake of this question, I am testing that a user is authenticated and also using .exists() calls to check if documents exist. Read the "..." in the document paths to read "/database/$(databases)/documents".

My questions is: How can I get multiple .get() calls to work in this senario?

Quick clarification of exactly what I am asking: How can I call more than one document other that the resource per rule. That seems to be the issue, I am testing against a products document (the resource) and a patient document and a staff document. — user10264162

Selast Lambou Selast Lambou · Accepted Answer · 2018-08-26T08:22:36

I quite don't understand your question. If you wanna know if all your get calls are gonna work, be sure they would. It's not a problem so far.

If you want to reduce your calls, for what you're doing you may declare a function to simplify your work.

Multiple .get() calls in Firestore Security Rules

1 Answers