nested firebase-firestore rules: owner id within parent document

问题

I can't get these rules to work: I've got a collection with projects, which all have an owner. The owner should be allowed to read/write his projects and the subcollection working_copies as well.

This implementation succesfully grants reading the project, but fails (Missing or insufficient permissions) when reading a working_copy from the sub collection. I suspect it tries to find an owner within the sub-document.

service cloud.firestore {

  match /databases/{database}/documents {

    match /projects/{projectId} {
      allow read, write: if 
        resource.data.owner == request.auth.uid;

      match /working_copies/{doc} {
        allow read, write: if true;
      }

  }
}

I've also tried using this condition either in the project path or in the working_copies path, but it both fails as well:

    get(/databases/$(database)/documents/projects/$(projectId)).data.owner == request.auth.uid

Everything above also fails when i use a recursive wildcard for nesting:

match /projects/{projectId=**} {
   ...

The strange thing is, i think the first version used to work until some days ago.

I use angular/angularfire and call the requests like this:

 this.db.collection('projects').doc('3279').collection<ProjectData>('working_copies').valueChanges().pipe(...

In the rules simulator it's green lighted though.

回答1:

I've finally found a workaround:

!('owner' in resource.data) || resource.data.owner == request.auth.uid

This makes it accept that the child document doesn't provide the owner once more. So it seems, when nesting rules, the parent rules are also applied to child documents.

来源：https://stackoverflow.com/questions/62538315/nested-firebase-firestore-rules-owner-id-within-parent-document