'User Access Roles In Firestore
I have Firestore setup as shown in the images below.



I am trying ensure that a user can only have access to projects of a specific company provided the user is authenticated (email and password), email-verified and is part of the users collection (by verifying with UID) for that company based on a specific role (eg. manager, dancer, choreographer).
I have created some rules as shown below but it is not working as expected. Thank you in advance for the contribution.
rules_version = '2';
service cloud.firestore {
match /databases/{database}/documents {
//create user creates own data in users collection
match /companies/company_id/users{
allow create: if request.auth != null && request.auth.token.email_verified == true;
}
//user should be allowed to create or delete own data.
//Only managers should be allowed to delete data of others
match /companies/company_id/users/{user_id}{
allow read, delete: if request.auth != null && request.auth.uid == user_id;
}
match /companies/{company_id}/projects {
allow write: if isManager(get(/databases/$(database)/documents/companies/{company_id}/users/$(request.auth.uid))) || isChoreographer(get(/databases/$(database)/documents/companies/{company_id}/users/$(request.auth.uid)));
allow read: if isDancer(get(/databases/$(database)/documents/companies/{company_id}/users/$(request.auth.uid)));
}
match /companies/{company_id}/project/{project_id} {
allow read, write: if get(/databases/$(database)/documents/companies/{company_id}/users/$(request.auth.uid)) == request.auth.uid;
}
function isManager(database){
return database.data.role == "manager";
}
function isChoreographer(database){
return database.data.role == "choreographer";
}
function isDancer(database){
return database.data.role == "dancer";
}
}
}
Any ideas?
EDIT I have included a curl script I used trying to access one of the firestore rules.
curl --location --request GET 'https://firestore.googleapis.com/v1/projects/project_somthin/databases/(default)/documents/companies/company_a/users/MSTJMcwggcGwrXgEgwl5' \
--header 'Authorization: Bearer token_id'
I go the error:
{ "error": { "code": 403, "message": "Missing or insufficient permissions.", "status": "PERMISSION_DENIED" } }
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
| Solution | Source |
|---|
