Configuring rules for Firestore so user only gets records they own

Question

This is a followup to this question
Firestore permissions

I'm trying to set rules on my firestore

service cloud.firestore {
  match /databases/{database}/documents {
    match /analysis/{analysis} {
      allow read, write: if request.auth.uid == resource.data.owner_uid;
    }
  }
}

My goal is
a. When doing a list operation only those documents belonging to a user are returned
b. only documents a user owns can be read or written by that user.

With the above configuration b. is accomplished.
how do I do accomplish a. ?

you can achieve that client side with a query. i think your first problem is not possible with rules. — Hareesh, Nov 28 '17 at 07:30

jeben · Accepted Answer · 2017-11-28T10:14:43.620

21

Remember that firestore rules are not filters, they're a server-side validation of your queries. You should always make your queries match your rules, or else you'll get permission errors.

In your case you already made the rule to enforce reading/listing on user owned documents. Now you simply have to make the corresponding query with the right filters :

const userId = firebase.auth().currentUser.uid

db.collection("analysis").where("owner_uid", "==", userId)

Another thing. With your current rules, your users won't be able to create a new document, only edit an existing one, here are the updated rules to allow that :

allow read: if request.auth.uid == resource.data.owner_uid;

allow write: if request.auth.uid == resource.data.owner_uid
             || request.auth.uid == request.resource.data.owner_uid;

edited Nov 28 '17 at 10:14

answered Nov 28 '17 at 09:52

jeben

585
4
8

Is it possible to restrict access based on filters rather than request.auth? – sheerun Jul 23 '18 at 12:07
@sheerun Do you have an example of what you'd like to achieve ? – jeben Jul 23 '18 at 16:53
I'ld like to allow users to perform only certain queries – sheerun Aug 10 '18 at 18:46
Thank you for this, I spent a long time looking for this info. Does anyone know where it's explained in the docs? – aurumpotestasest Feb 25 '19 at 21:07
Thanks, this helped a lot -- also found it in the docs, here: https://firebase.google.com/docs/firestore/security/rules-query#queries_and_security_rules – leocreatini Jul 06 '19 at 01:53

Configuring rules for Firestore so user only gets records they own

1 Answers1

Linked