CODEWITHSUNDEEP
google-cloud-firestorefirebase-security
sdfsdf
sdfsdf

Reputation: 5590

How do you allow only admins to read certain fields in a document in Cloud Firestore?

I have a collection of documents where there are some fields anyone should be able to only read and some fields where only the admin should be able read/write. My rules look something like

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /MyCollection/{document=**} {
      allow read: if request.auth.token.admin == true;
      allow write: if request.auth.token.admin == true;
      match /publicField {
        allow read: if true;
      }
    }
  }
}

but I get a Missing or insufficient permissions err when I try to read the documents. How do I allow anyone to read the publicField of any MyCollection document?

Upvotes: 0

Views: 173

Answers (1)

Doug Stevenson
Doug Stevenson

Reputation: 317362

It's not possible to change the access of individual fields in a single document. Match patterns can only target document paths, and don't know anything about document fields. If anyone can read a document, then they can always read the entire document.

If you want to change the permissions of some data in a document, they need to be split into another document in a collection that has appropriate security rules.

You might be interested in reading: The trade-offs between performance, cost, and security with Firestore

Upvotes: 3

Related Questions