消防安全规则-删除规则无效

Question

我试图配置我的防火墙安全规则，以便所有用户都可以读取数据，但只有登录用户才能发布帖子并删除自己的帖子。delete功能不起作用，并产生以下错误：

FirebaseError:缺少或不足的权限。

我已经将我的安全规则配置如下：

rules_version = '2';
service cloud.firestore {
    match /databases/{database}/documents{
  match/gig-listing/{document = **} {
  allow write: if request.auth.token.admin ==true;
  allow delete: if isAuthenticated() && request.auth.uid == resource.data.userId;
  allow read;
  }
  }
}

function isAuthenticated(){
return request.auth != null;
}

..and控制删除的组件如下：

import React, {useState, useEffect} from 'react'
import Giglisting from './Giglisting'
import Button from "@material-ui/core/Button";
import { withStyles } from '@material-ui/core/styles';
import firebase from 'firebase'

const StyledButton = withStyles({
    root: {
      background: '#54ADA6',
      borderRadius: 3,
      border: 0,
      color: 'white',
      height: 30,
      padding: '0 30px',
      marginRight: '1px'
      
    },
    label: {
      textTransform: 'capitalize',
    },
  })(Button);


const UniqueVenueListing = (props) => {
    
const gigList = props.gigList
const ref = firebase.firestore().collection('gig-listing')

const deleteGig = (gigs) => {
    ref
    .doc(gigs.id)
    .delete()
    .catch(err => {
        console.error(err)
    })
}

    return(
        <div>
          {
              gigList.map(gigs => {
                  let name = gigs.data().name
                  let genre = gigs.data().genre
                  let time = gigs.data().time
                  let tickets = gigs.data().tickets
                  let price = gigs.data().price
                 return <Giglisting
                 gigtitle = {name}
                  genre = {genre}
                  time = {time}
                  buytickets = {tickets}
                  price = {price}
                  button = {<StyledButton onClick ={() => deleteGig(gigs)}>Delete Gig</StyledButton>}
                  />
              })
            }
        </div>
    )
}

export default UniqueVenueListing

我也尝试了allow delete: if request.auth.token.admin ==true;，没有运气。有什么建议吗？

Answer 1

您可以尝试使用以下安全规则配置，以避免与您在共享的安全规则配置上定义的write规则发生冲突。注意，通过通过其粒度操作打破write规则，您可以隔离delete规则并获得所需的行为。查找所有相关信息这里

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    // Matches any document in the 'gig-listing' collection or subcollections.
    match /gig-listing/{document=**} {
      // Allow everyone to read documents in the 'gig-listing' collection 
      //or subcollections
      allow read;
      //Separating the write functionality as per granular operations 
     //to isolate the delete command
      allow delete: if request.auth.uid == resource.data.userid;
      allow create, update: if request.auth.uid != null;
    }
  }
}

我发现文档的这另一节对于定义安全规则和如何查询数据非常有用。