防火墙安全规则阻止侦听器

Question

遇到firestore安全规则阻止我的实时侦听器的问题

以下是安全规则：

rules_version = '2';
service cloud.firestore {
match /databases/{database}/documents {
match /{document=**} {
function isAdmin(uid) {
return get(/databases/$(database)/documents/employees/$(uid)).data["Type"] == "Admin";
}
match /transactions/{transactionID} {
//allow transaction if admin or if the user making the request is the EID of the relevant assignment
allow read, create: if isAdmin(request.auth.uid) ||
get(/databases/$(database)/documents/assignments/$(resource.data.assignment)).data.EID == request.auth.uid;
}
match /threads/{threadID} {
allow read, write: if resource.data.Parties[0] == request.auth.uid ||
resource.data.Parties[1] == request.auth.uid;
}
match /sites/{siteID} {
allow read;
}
match /employees/{employeeID} {
allow read, write: if isAdmin(request.auth.uid) ||
(employeeID == request.auth.uid)
}
match  /employees/{employeeID}/EditHistory {
allow read, write: if isAdmin(request.auth.uid) ||
(employeeID == request.auth.uid)
}
match /employees/{employeeID}/Sessions {
allow read, write: if isAdmin(request.auth.uid) ||
(employeeID == request.auth.uid)
}
match /directory/{any} {
allow read;
}
match /assignments/{assignmentID} {
allow read, write: if isAdmin(request.auth.uid) ||
get(/databases/$(database)/documents/assignments/$(assignmentID)).data.EID == request.auth.uid;
}
match /analytics {
allow read: if isAdmin(request.auth.uid);
}
}
}
}

我所有的听众都被错误"；"权限不足"；，但当我在安全规则操场上尝试相应的get查询时，它们是允许的。

以下是我尝试的查询示例。

firebase.auth().onAuthStateChanged(user => {
if (user) {
unsubscribeTimetrackingListener = firebase.firestore().collection('employees').doc(currentUser.uid).collection("Sessions").where("Date", "==", generateDateStr(0))
.onSnapshot((querySnapshot) => {
fetchHistory();
}, (err) => {
console.error("Timetracking Listener Error: ", err);
})
}
});

从这里开始，我可以采取什么步骤来尝试调试侦听器被阻止的原因吗？

谢谢。

Answer 1

我会这样写你的嵌套安全规则：

match /employees/{employeeID} {
allow read, write: if isAdmin(request.auth.uid) ||
(employeeID == request.auth.uid)
match  /EditHistory/{history} {
allow read, write: if isAdmin(request.auth.uid) ||
(employeeID == request.auth.uid)
}
match /Sessions/{session} {
allow read, write: if isAdmin(request.auth.uid) ||
(employeeID == request.auth.uid)
}
}

通常，授予对文档的访问权限是特定于该级别的——它不会自动扩展到允许子级别。上面的嵌套规则添加了对嵌套集合的访问权限。

你也可以写：

match /employees/{employeeID} {
allow read, write: if isAdmin(request.auth.uid) ||
(employeeID == request.auth.uid)
}
match  /employees/{employeeID}/EditHistory{histories} {
allow read, write: if isAdmin(request.auth.uid) ||
(employeeID == request.auth.uid)
}
match /employees/{employeeID}/Sessions/{sessions} {
allow read, write: if isAdmin(request.auth.uid) ||
(employeeID == request.auth.uid)
}

[注意添加了｛history｝和｛sessions｝]