拒绝Firestore权限，尽管规则匹配文档集路径

Question

我没主意了。希望新的眼光能有所帮助。

我有以下安全规则：

function isUser (request, userKey) {
  return request.auth.uid == userKey;
}

function isAuthorized(request){
    return request.auth.uid != null;
}

function isAdmin (request) {
  return root.child('users').child(request.auth.uid).child('isAdmin').val() == true;
}

service cloud.firestore{
    match /databases/{database}/documents {
        match /users/{uid} {
          allow create: if isAuthorized(request) || isAdmin(request);
          allow update: if isUser(request, uid) || isAdmin(request);
        }

        match /userReadable/{objectType}/{uid} {
          allow read: if isUser(request, uid) || isAdmin(request);
          allow write: if isAdmin(request);
        }

        match /userWriteable/{objectType}/{uid} {
          allow read: if isAdmin(request);
          allow write: if isUser(request, uid) || isAdmin(request);
        }

        match /userOwned/{objectType}/{uid} {
          allow read: if isUser(request, uid) || isAdmin(request);
          allow write: if isUser(request, uid) || isAdmin(request);
        }
    }
}

我正在下面的代码中设置文档：

 FirebaseFirestore db = getDB();
        PulseFirebaseModel pulse = new PulseFirebaseModel((PulseModel) object);
        try {
            final DocumentReference doc = db.collection(COLLECTION_USER_WRITABLE)
                    .document(OBJECT_PULSE_SAMPLE)
                    .collection(FirebaseApp.getInstance().getUid())
                    .document();

            doc.set(pulse, SetOptions.merge())
                    .addOnCompleteListener(new OnCompleteListener<Void>() {
                        @Override
                        public void onComplete(@NonNull Task<Void> task) {
                            if(task.isSuccessful()){
                                Log.d(TAG, "Saved sample: " + doc.getId() +"\t"+doc.getPath());
                                onSuccess();
                            }else{
                                onFailure("Could not save Ppg\t"
                                        + task.getException().getMessage()
                                        + "\ndoc Path:" + doc.getPath()
                                        + "\ndoc id: " + doc.getId()
                                        + "\n" + task.getResult());
                            }
                        }
                    });
        } catch (FirebaseApiNotAvailableException e) {
            e.printStackTrace();
        }
    }

我简直想不通。任何帮助都将不胜感激。

Answer 1

由于使用document（）写入自动生成的文档ID，因此规则需要在路径末尾包含文档ID的通配符：

match /userWriteable/{objectType}/{uid}/{docId} { // <== added /{docId}
  allow read: if isAdmin(request);
  allow write: if isUser(request, uid) || isAdmin(request);
}