firebase-security - Firestore 规则，什么是集合和文档？

Question

我的意思是我知道那些是什么，但我对安全规则有点困惑，例如:

service cloud.firestore {
  match /databases/{database}/documents {
    // This is probably a mistake
    match /spaceships { // <= what is this a collection or a document?
      allow read;
      // In spite of the above line, a user can't read any document within the 
      // spaceship collection.
    }
  }
}

Firebase 文档说:

Rules for collections don't apply to documents within that collection. It's unusual (and probably an error) to have a security rule that is written at the collection level instead of the document level.

这意味着这个 match /spaceships {...是一个集合吗？

但后来我们有这个:

service cloud.firestore {
  match /databases/{database}/documents {
    match /{document=**}{ // <= what is this a document or a collection?
      allow read, write: if true;
    }
  }
}

我不明白这是 match /{document=**}{...一份文件？还是一个集合？我的意思是在收藏层面。

Answer 1

Firestore 中的路径是交替的集合和文档:/collection/document/subcollection/subdocument
例如:

// Matches kaylee, the mechanic on serenity
/spaceships/serenity/crew/kaylee/...

使用安全规则时，您可以指定通配符:

// This will match any spaceship, and any crewmember
/spaceships/{spaceshipId}/crew/{crewmemberId}/...

现在假设您在 spaceships 下有另一个子集合。 :

/spaceships/{spaceshipId}/stowaways/{stowawayId}/...

如果要针对多个子集合编写规则，则需要:

// You could use multiple single wildcards
/spaceships/{spaceshipId}/{crewOrStowaway}/{crewOrStowawayId}/...

// Or you could use a multi-segment wildcard
/spaceships/{spaceshipId}/{allShipInformation=**}

这将返回 allShipInformation作为路径，它将匹配该路径及其下方的所有文档和集合。请注意，它是一个或多个路径段，而不是零个或多个。

您可以阅读有关此内容的更多信息 in the docs