CODEWITHSUNDEEP
firebasegoogle-cloud-firestorefirebase-security
Kijunior
Kijunior

Reputation: 37

Firestore rules to allow write on two separate Uids

enter image description hereenter image description hereI am writing a chat application and am done apart from the security rules section. I am currently creating two documents for each message (one each for each user) I am okay with writing a document to my user Id but the database isn't allowing for a write in the other paired user Id.

I have tried by allowing the write if the userId is in the resource.data of the other file

match /message/{user}/{chatRoomID}/{messageId} {
  allow read, write: if request.auth.uid == user || request.auth.uid in resource.data;
}

How can I make it so whenever a message is sent to the database it is only read and can be written by the specific user Ids?? Each message object has reference to who sent it (each user's object Id). Thanks in advance !!

Upvotes: 1

Views: 115

Answers (1)

Frank van Puffelen
Frank van Puffelen

Reputation: 599166

While in is indeed an operator in security rules, this won't work:

request.auth.uid in resource.data

The in operator checks if a key exists in a map, where it is much more likely that you store the UID of the other user in the value of a field.

To check whether a certain field has a specific value, use something like this:

request.auth.uid == resource.data.senderID

Upvotes: 1

Related Questions