🛂 How to query a subset of a collection that is permission based allowed by the rules.

[Norfeldt]

Vuefire 🌈 is the perfect firebase wrapper be simplifying the reactivity to vue 👐. However I need some guidance how how to do permission based querying.

Say I have Categories collection with two documents: technology and analog (is their document id as well). I have a user which should have read access only to Tech.

rules_version = '2';

service cloud.firestore {
  match /databases/{database}/documents {
    match /categories/{categoryId} {
      allow read: if get(/databases/$(database)/documents/users/$(request.auth.uid)).data.categoryReadAccessList.hasAny([categoryId]);
    }

    match /users/{userId} {
      allow read: if request.auth.uid == userId;
    }
  }
}

In my code I would write it like so:

const currentUser = useCurrentUser()
const { data: user } = useDocument<User>(doc(useFirestore(), 'users', currentUser.value!.uid))
const categories = useCollection<Category>(
  computed(() => {
    const categoriesCollection = collection(useFirestore(), 'categories')
    // debugging purpose 👇
    // return query(categoriesCollection, where('id' satisfies keyof Category, 'in', 'technology'))

    if (user.value && user.value.categoryReadAccessList) {
      return query(categoriesCollection, where('id' satisfies keyof Category, 'in', user.value.categoryReadAccessList))
    }

    return query(categoriesCollection, where('id', '==', null))
  })
)

Looking at the requests in the emulator:

(I do find it confusion that it's called resource and not request.resource)

It seems like it first try to get the entire collection, gets blocked by rules, and then it would query to filter the response.

If anyone has a suggestion on how to a more granular permission than just roles, I would be very interested in hearing about it.

[Norfeldt]

Sometimes you gotta ask the question to find the answer 🦆

Found out that it's the wildcard {categoryId} that was causing the trouble. Had to use resource.data.id instead

get(/databases/$(database)/documents/users/$(request.auth.uid)).data.categoryReadAccessList.hasAny([resource.data.id])

A "logical" explanation would be that {categoryId} is a wildcard, so not limited by the query. Where resource.data has been limited by the query.