Missing or Insufficient permissions on Firestore Security Rule with get()

Question

Pretty much no matter what I use for the get() request, getting Missing or insufficent permissions when logged in with a userID that is a "member":

function isSelf(userID) {
    return request.auth != null && request.auth.uid != null && request.auth.uid == userID
}

function isMember(userID) {
    return request.auth != null && request.auth.uid != null && get(/databases/$(database)/documents/'members'/$(request.auth.uid)).data.parent == userID
}

match /templates/{userID} {
    allow read, write: if false
    
    match /templates/{templateID} {
        allow read: if isSelf(userID) || isMember(userID)
      allow write: if isSelf(userID)
      allow delete: if false
    }

    allow read: if isSelf(userID) || isMember(userID)
    allow write: if isSelf(userID)
  }

Have tried using get() with .data.parent and with .parent The member doc looks like this:

{
  parent: 'USER_ID_OF_PARENT'
}

Call from the client app is:

export const getTemplate = async ({ userID, form }) => {
 db.collection('templates').doc(userID).collection('templates').doc(form).get()
    .then((doc) => {
    })
    .catch((err) => {
      console.error(err)
    })
}

Database structure is:

/templates/{userID} is a collection of docs with ids as userIDs that correspond to a doc with matching userID in /users/{userID}
/members/{memberID} is a collection of docs with ids as memberIDs, with a parent field with a string value SOME_USER_ID which matches a doc with userID SOME_USER_ID in /users/{userID}

Example:

/members/'MEMBER_1' doc:

{
  name: 'Member 1',
  parent: 'OWNING_USER_1'
}

/users/'OWNING_USER_1' doc:

{
  name: 'Owning User 1',
  parent: 'OWNING_USER_1'
}

/templates/'OWNING_USER_1' doc:

{
  // no fields
}

/templates/'OWNING_USER_1'/templates/'FORM_1' doc:

{
  name: 'Form 1'
}

With the following call:

getTemplate({
  userID: 'OWNING_USER_1',
  form: 'FORM_1'
})

When the authenticated user is OWNING_USER_1, the above call is successful (the isSelf() rule returns as true) and the found template document is returned
When the authenticated user is MEMBER_1, the above call gets Missing or insufficient permissions (the isMember() rule returns false)

Missing or Insufficient permissions on Firestore Security Rule with get()

Answers (1)

Related Questions