Firebase / Cloud Firestore / Rules Setup (read, write, update, delete)

Question

I'm having a bit of trouble trying to configure my Cloud Firestore rules.

I'm trying to access a field inside a document, inside a collection... Like this

 Future<void> fetchAndSetProducts([bool filterByUser = false]) async {
    final filterString = filterByUser
        ? Firestore.instance.collection('products').getDocuments()
        : Firestore.instance
            .collection('products')
            .where('creatorId', isEqualTo: userId)
            .getDocuments();
    try {
      QuerySnapshot prodSnap = await filterString;

      if (prodSnap == null) {
        return;
      }

'creatorId' is a field within database/products/{productId}

I want to distinguish between users and only allow them to update, and delete files they've created within database/products/... , but I also want them to be able to view all the documents inside of /products/...

the bool I have set up for fetchAndSetProducts is what I'm hoping to use to filter some of the information app side, e.g. only allowing using to view certain products (ones containing their userId). I'm not sure if I also needs to set up indexing on "products", but I have done already just in case..

So, I want to lock down all files that weren't created by a user.

I thought it would be something like this:

service cloud.firestore {
  match /databases/{database}/documents {
    match /products/{productId}/documents{
    allow read: if resource.data.creatorId == request.auth.uid;
    }
  }
}

buuut that doesn't work, and nor does my app-side code for filtering by user..

Please edit the question to explain what isn't working the way you expect, including client code that you've debugged and are sure exactly what it's doing. — Doug Stevenson

Doug Stevenson Doug Stevenson · Accepted Answer · 2019-10-29T21:10:39

If you want to match all documents in the products collection, it would look like this:

service cloud.firestore {
  match /databases/{database}/documents {
    match /products/{productId} {
      allow read: if resource.data.creatorId == request.auth.uid;
    }
  }
}

Notice that I removed the "documents" from the end of the second match.

Firebase / Cloud Firestore / Rules Setup (read, write, update, delete)

1 Answers