Firestore 无效权限：request.auth.uid in

Question

我正在使用 Cloud Firestore，但我似乎无法让“IN”运算符使用安全规则。我尝试过使用数组和地图，但都不起作用。当然，当我将其设置为 allow read, write; 时，它工作正常。我做错了什么？

规则：

service cloud.firestore {
  match /databases/{database}/documents {
    match /rooms/{roomId=**} { 
      allow read, write: if request.auth.uid in resource.data.users;
      allow read, write: if request.auth.uid in resource.data.users2;
      allow create: if request.auth != null;
    }
    match /user-rooms/{userId} { 
      allow read, write: if userId == request.auth.uid;
    }
    match /users/{userId} {
      allow read, write: if request.auth.uid == userId;
      allow get, create: if request.auth != null;
    }
  }
}

客户：

db.collection("rooms")
  .document(self.room.getRoomId())
  .collection("messages")
  .addSnapshotListener { .....

//Room is: d6l946swspNSouANzVdZ
//Username is: eX8gkxJNDREv

Answer 1

data 将返回它的直接子级而不是子级（用户和用户2）所以你应该使用get 和exists 而不是in

match /rooms/{roomId=**} { 
  allow read, write: if request.auth.uid in get(/databases/$(database)/documents/rooms/$(roomId)/users/$(request.auth.uid)).data;
  allow read, write: if exists(/databases/$(database)/documents/rooms/$(roomId)/users2/$(request.auth.uid));
  allow create: if request.auth != null;
}

查看doc

Answer 2

您正在尝试访问 resource.data 中不存在的名为“users”的变量。 resource 变量包含来自当前正在写入数据库的对象的数据。

您可能想要做的是检查此用户是否存在于users 和users2 字段中，这可以通过规则来实现：

match /rooms/{roomId=**}{
    allow read, write:  if (exists(/databases/$(database)/documents/rooms/$(roomId)/users2/$(request.auth.uid)) || 
                         request.auth.uid in get(/databases/$(database)/documents/rooms/$(roomId)).data.users);
    allow create: if request.auth!=null;
}