javascript - firebase 存储检查写入模式错误的元数据

Question

嗨，在我的存储规则中，我有这个代码

match /Image/{user}/{image}/image.jpg {
      allow write: if request.auth != null && (request.auth.uid == user || request.auth.uid == 'nodeserver') && (resource.metadata['private'] == true || resource.metadata['private'] == false)
      allow read: if request.auth != null && (request.auth.uid == user || resource.metadata.private == false)
    }

如果我尝试像这样在客户端编写自定义元数据

 var imageRef = storageRef.child('Image/' + uid + '/' + imageId + '/image.jpg');

            var metadata = {
                customMetadata: {
                    private: false 
                }
            };

            var imgref = imageRef.put(image, metadata);

我从 firebase 服务器收到这个错误

POST https://firebasestorage.googleapis.com/v0/b/project-4815133492804887736.app…Image%2F39IhnMU70uYrhJ9Y0XWBEMtQDR63%2F-KMP9NDx3D2gjJix3bpL%2Fimage.jpg 403 ()
service.js:303 x {code: "storage/unauthorized", message: "Firebase Storage: User does not have permission to…hJ9Y0XWBEMtQDR63/-KMP9NDx3D2gjJix3bpL/image.jpg'.", serverResponse: "{↵  "error": {↵    "code": 403,↵    "message": "Pe…n denied. Could not perform this operation"↵  }↵}", name: "FirebaseError"}code: "storage/unauthorized"message: "Firebase Storage: User does not have permission to access 'Image/39IhnMU70uYrhJ9Y0XWBEMtQDR63/-KMP9NDx3D2gjJix3bpL/image.jpg'."name: "FirebaseError"serverResponse: "{↵  "error": {↵    "code": 403,↵    "message": "Permission denied. Could not perform this operation"↵  }↵}"__proto__: Error__proto__: Object

如果我从规则中删除这段代码

(resource.metadata['private'] == true || resource.metadata['private'] == false)

一切正常，但我想验证元数据。解决方案是什么？

Answer 1

您想使用 request.resource 而不是 resource。这是因为resource是指当前存在的(已经存储的文件)，而request.resource是指请求上的资源(正在上传的文件)。

match /Image/{user}/{image}/image.jpg {
  allow write: if request.auth != null && (request.auth.uid == user || request.auth.uid == 'nodeserver') && (request.resource.metadata['private'] == true || request.resource.metadata['private'] == false)
  allow read: if request.auth != null && (request.auth.uid == user || resource.metadata.private == false)
}

注意 read 规则应该使用 resource 因为它指的是已经存在的文件，而 write 规则需要引用request.resource 因为这是正在上传的内容。