基于角色的身份验证取决于 google cloud firestore 规则中的组

Question

我正在尝试保护用户可以管理其乐队的应用。用户可以是多个乐队的一部分，因此可以根据他们当前正在编辑的乐队担任不同的角色。角色存储在 Band 文档中的 Map 中。

有什么方法可以将此应用于 Firestore 规则？这样函数 getRole() 不仅适用于“bands”，还适用于包含 idBand 字段的其他集合（如“events”）

我的设置如下所示：

我试图做这样的事情：

function getRole(){
    return get(/databases/{database}/documents/bands/request.resource.data.idBand/members/$(request.auth.uid)).data.role
}

match /bands/{document=**}  {
    allow read;
  allow write: if getRole() == 'OWNER';
}  

Answer 1

试试这样的：

// Rules for a band document and its subcollections
match /bands/{bandID}{

  function isBandOwner(userID){ 
    // Determine if user is a band owner
    return get(/databases/$(database)/documents/bands/$(bandID)).data.members[userID].role == 'OWNER';
  }

  // Anyone can read
  allow read;

  // Only authenticated owners can write to band doc
  allow write: if request.auth != null && isBandOwner(request.auth.uid);

   // Rules for all of a band's subcollections
     match /{document=**}{

     // Anyone can read
     allow read;

     // Only authenticated owners can write to a band's subcollections
     allow write: if request.auth != null && isBandOwner(request.auth.uid);

   }        
}

为了试一试，我们也限制读取，尝试读取一些测试文档：

allow read: if isBandOwner(request.auth.uid);

Set up Firebase Auth with Google Sign-in 并尝试从 Cloud Firestore 读取：

<script src="https://www.gstatic.com/firebasejs/5.5.9/firebase.js"></script>
<script>
  // Initialize Firebase
  // TODO: Replace with your project's customized code snippet
  var config = {
    apiKey: "<API_KEY>",
    authDomain: "<PROJECT_ID>.firebaseapp.com",
    databaseURL: "https://<DATABASE_NAME>.firebaseio.com",
    projectId: "<PROJECT_ID>",
    storageBucket: "<BUCKET>.appspot.com",
    messagingSenderId: "<SENDER_ID>",
  };
  firebase.initializeApp(config);

  //Sign in with Google
  var provider = new firebase.auth.GoogleAuthProvider();

  firebase.auth().signInWithPopup(provider).then(function(result) {
  // This gives you a Google Access Token. You can use it to access the Google API.
  var token = result.credential.accessToken;
  // The signed-in user info.
  var user = result.user;
  console.log(`UserId: ${user.uid}`)

  // Try reading Firestore docs
  var db = firebase.firestore();

    // Disable deprecated features
    db.settings({
      timestampsInSnapshots: true
    });

    // This doc has members.[my-uid].role = "OWNER"
    // Read should succeed
    db.doc("bands/abc").get().then((doc) => {
            console.log(`${doc.id} => ${doc.data().name}`);
    });

    // This doc has members.[my-uid].role = "BANDMEMBER"
    // Read should fail
    db.doc("bands/def").get().then((doc) => {
            console.log(`${doc.id} => ${doc.data().name}`);
    });
  // ...
}).catch(function(error) {
  // Handle Errors here.
  var errorCode = error.code;
  var errorMessage = error.message;
  // The email of the user's account used.
  var email = error.email;
  // The firebase.auth.AuthCredential type that was used.
  var credential = error.credential;
  // ...
  console.log('error login');
});
</script>