query.startAt database rule permission denied

问题

Seems like either the query.startAt rule is broken, or I don't understand it. Can someone confirm? Here is the minimal reproducible error. Live example; open Chrome console with CTRL+SHIFT+i. GitHub repo.

database.rules.json:

{
 "rules":{
  ".read": "query.startAt>0",
  ".write": false
 }
}

index.html

<!DOCTYPE html>
<html>
<body>
 <script src="/__/firebase/7.6.1/firebase-app.js"></script>
 <script src="/__/firebase/7.6.1/firebase-database.js"></script>
 <script src="/__/firebase/init.js"></script>
 <script>
  function init(){
   firebase.database.enableLogging(true);
   const db=firebase.database();
   const qry=db.ref("/").orderByChild('time').startAt(3);
   //logging shows permission denied on next line
   qry.once('value',s=>console.log("snapshot",s.val()));
  }

  init();
 </script>
</body>
</html>

database contents:

Chrome browser console output shows permission denied:

...snip...
@firebase/database: p:0: Listen on / for {"i":"time","sp":3} 
@firebase/database: p:0: {"r":2,"a":"q","b":{"p":"/","q":{"sp":3,"i":"time"},"t":1,"h":""}} 
...snip...
@firebase/database: p:0: from server: {"r":2,"b":{"s":"permission_denied","d":"Permission denied"}} 
@firebase/database: p:0: listen response {"s":"permission_denied","d":"Permission denied"} 
@firebase/database: event: /:cancel

If database.rules.json is changed to:

{
 "rules":{
  ".read": true,
  ".write": false
 }
}

The permission denial of the listen disappears from the browser console:

...snip...
@firebase/database: p:0: Listen on / for {"i":"time","sp":3} 
@firebase/database: p:0: {"r":2,"a":"q","b":{"p":"/","q":{"sp":3,"i":"time"},"t":1,"h":""}} 
...snip...
@firebase/database: p:0: handleServerMessage d {"p":"","d":{"msg1":{"time":11}}} 
@firebase/database: event: /:value:{"msg1":{"time":11}} 
01:45:21.044 (index):13 snapshot {"msg1":{"time":11}}
@firebase/database: p:0: from server: {"r":2,"b":{"s":"ok","d":{"w":["no_index"]}}} 
...snip...

This was reduced from a larger application, where it manifested with logged in users.

回答1:

firebaser here

I can reproduce this problem, and as far as I can see your rules look fine.

In my testing, when using query.startAt == 3 the rules correctly allow the read, but using > or >= the rules reject the read operation.

Can you file a bug report to see if this is a bug in the rules module, or if we're both missing something about your rules?

Update: the problem seems to come from a misinterpretation of types in the rules engine. For example, when you ensure all numbers are floating point it works: