FirebaseError: "Missing or insufficient permissions." Subcollection queries in a serverless app

Question

I am testing subcollection queries deployed from my serverless angular application. I have a top lvl collection User (2 sub documents) with a nested collection secret each containing a document indexed contact_details (for both users)
For firestore rules I use

rules_version = '2';
match /databases/{database}/documents {
   match /user/{path=**}/secret/{secret_id} {
       allow read: if true;
   }
}

And on my angular serverless client I am using AngularFirestore to query the subcollection secret like this:

this.firestore.collectionGroup('secret').get().subscribe(
    (sec) => { sec.forEach(el => console.log(el.data())) },
    (error) => { console.error(error) }
);

My expected behavior would be to retrieve all documents from the subcollection secret nested in the two user documents. The error output I get from the console.error statement is as follows:

FirebaseError: "Missing or insufficient permissions."
FirestoreError index.cjs.js:350
fromRpcStatus index.cjs.js:15441
fromWatchChange index.cjs.js:15954
onMessage index.cjs.js:11877
startStream index.cjs.js:11806
getCloseGuardedDispatcher index.cjs.js:11846
newTail index.cjs.js:1688
invoke zone-evergreen.js:359
run zone-evergreen.js:124
scheduleResolveOrReject zone-evergreen.js:855
invokeTask zone-evergreen.js:391
runTask zone-evergreen.js:168
drainMicroTaskQueue zone-evergreen.js:559
invokeTask zone-evergreen.js:469
invokeTask zone-evergreen.js:1603
globalZoneAwareCallback zone-evergreen.js:1629

In the firestore rules simulator I already successfully tried to query:

get /user/(placeholder)/secret/contact_details

Also I tested subcollection queries with a priveledged server (node.js) set up which worked as expected. I would guess my security rules are off, but I can't figure out what exactly is the problem, as I modified the firestore rules based on the documentation. I appreciate any help!

score 4 · Accepted Answer · answered Nov 05 '19 at 08:24

After trying a little bit more I came to the conclusion that subcollection query rules have to start with the path wildcard first like:

match /{path=**}/secret/...

It seams to be forbidden to nest them in a route like I tried before:

match /user/{path=**}/secret/...

With these changes I get the expected results.

FirebaseError: "Missing or insufficient permissions." Subcollection queries in a serverless app

1 Answers1