javascript - Firestore 返回的权限不足，即使不应该

Question

我为 Firestore 数据库设置了以下规则:

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {

    match /collections/{document=**} {
        allow read;
        allow write: if isAdmin();
        }

    match /general/{document=**} {
        allow read;
        allow write: if isAdmin();
        }

    match /inquiries/{document=**} {
        allow write;
        allow read: if isAdmin();
        }

    match /orders/{document=**} {
        allow write;
        allow read: if isAdmin() || resource.data.userID == request.auth.uid;
        }

    match /products/{document=**} {
        allow read;
        allow write: if isAdmin();
        }

    match /users/{userId} {
        allow write, read: if belongsTo(userId);
        }

    function belongsTo(userId) {
        return request.auth.uid == userId
        }

    function isAdmin() {
        return resource.data.admin == true;
    }
  }
}

如您所见，每个人都可以阅读/products 及其文档以及子集合。这适用于产品，但不知何故无法读取产品的子集合(每个产品都有一个名为 collection-colors)。

FirebaseError: Missing or insufficient permissions.

导致错误的代码:

retrieveCollectionColors(name) {
    this.db.collectionGroup('collection-colors', ref => ref.where('product', '==', name))
      .valueChanges().subscribe( (val: []) => {
      this.collectionColors.next(val);
    }, error => {
      console.log(error);
    });
}

Answer 1

您现在的规则根本不适用于集合组查询。您需要为此编写一条特殊规则。来自 documentation :

Secure and query documents based on collection groups

In your security rules, you must explicitly allow collection group queries by writing a rule for the collection group:

• Make sure rules_version = '2'; is the first line of your ruleset. Collection group queries require the new recursive wildcard {name=**} behavior of security rules version 2.
• Write a rule for you collection group using match /{path=**}/[COLLECTION_ID]/{doc}.

因此，如果您想允许集合组查询“集合颜色”，它将如下所示:

match /{path=**}/collection-colors/{doc} {
  allow read: ...
}

这将适用于具有给定名称的所有子集合。您不能根据父集合的名称有选择地允许或禁止子集合。