Can't get Firestore Rules get() to work inside a function

Question

Firestore doesn't work well with get inside a function

I have this rule

service cloud.firestore {
  match /databases/{database}/documents {

    function isProjectOpenForAssign() {
      return get(/databases/$(database)/documents/projects/$(anyProject)).data.canAssignTask == true;
    }

    match /projects/{anyProject} {
      allow create: if request.auth != null;

      match /tasks/{anyTask} {
        allow create: if request.auth != null && (isProjectOpenForAssign());
      }
    }
  }
}

When running the simulator testing it I get:

Error running simulation — Error: simulator.rules line [23], column [14]. Function not found error: Name: [get].; Error: Invalid argument provided to call. Function: [get], Argument: ["||invalid_argument||"]

Frank van Puffelen Frank van Puffelen · Accepted Answer · 2019-07-04T18:22:39

The problem is in the scope of where you define your function. Since you define isProjectOpenForAssign at the same level as this match match /projects/{anyProject}, the function won't have access to anyProject.

There are two solutions:

Pass anyProject as a parameter to isProjectOpenForAssign.

function isProjectOpenForAssign(anyProject) {
  return get(/databases/$(database)/documents/projects/$(anyProject)).data.canAssignTask == true;
}

match /projects/{anyProject} {
  allow create: if request.auth != null;

  match /tasks/{anyTask} {
    allow create: if request.auth != null && (isProjectOpenForAssign(anyProject));
  }
}

Define the function inside the match that declares anyProject.

match /projects/{anyProject} {
  function isProjectOpenForAssign() {
    return get(/databases/$(database)/documents/projects/$(anyProject)).data.canAssignTask == true;
  }

  allow create: if request.auth != null;

  match /tasks/{anyTask} {
    allow create: if request.auth != null && (isProjectOpenForAssign());
  }
}

Can't get Firestore Rules get() to work inside a function

1 Answers