Firebase Firestore: custom admin access

Question

In Firebase Firestore, I\'m trying to allow only (custom-assigned) admins to write/update/delete resources, and for that I\'ve got these security rules:

service          


        

Answer 1

While writing my question, I made it work! I made two mistakes, both of which could have been avoided if I read the docs properly.

Firstly, all calls to the service-defined function get needs to prefix the path with /databases/$(database)/documents/. So that this rule:

allow write: if get(/users/$(request.auth.uid)).isAdmin;

becomes this:

allow write: if get(/databases/$(database)/documents/users/$(request.auth.uid)).isAdmin;

It's long, I know, but that's how it is. I'm not sure why Firestore isn't able to do that by itself, though, seeing as that same path prefix will stay the same across all calls to get, but perhaps this is for some future feature that isn't ready yet, like cross-database querying or something.

Second, the get function will return a resource, which in turn you'll need to call .data on to get the actual data that it contains. Thus, instead of doing this:

get(/path/to/user/).isAdmin

you'll need to do this:

get(/path/to/user/).data.isAdmin

---

Now I just wish I was able to extract that logic into a user-defined function:

function isAdmin() {
  return get(/databases/$(database)/documents/users/$(request.auth.uid)).data.isAdmin;
}

But doing so results in a PERMISSION_DENIED again, and without knowing what's actually going on in the function, I'm not sure if I'll spend more time trying to figure this out now.

UPDATE: @Hareesh pointed out that functions must be defined within the scope of a matcher, so it's possible to put the function in the default top-level matcher like this:

service cloud.firestore {
  match /databases/{database}/documents {
    function isAdmin() {
      return get(/databases/$(database)/documents/users/$(request.auth.uid)).data.isAdmin == true;
    }

    // ...
  }
}