CODEWITHSUNDEEP
javascriptfirebasesecuritygoogle-cloud-firestorefirebase-security
LambentLight
LambentLight

Reputation: 87

Firebase Firestore only allow user to query a collection if there is a filter

I'm trying to create a Firestore rule which only allows a user to list documents from a collection where they're filtering a field.

// would fail:
db.collection('documents').get();

// would succeed:
db.collection('documents').where('fieldId', '==', 123456).get();

Is there a way to accomplish this through Firestore rules?

Upvotes: 1

Views: 411

Answers (2)

LambentLight
LambentLight

Reputation: 87

I got it working with

allow list: if int(resource.data.fieldId) > 100000000000000000;

since all of the ids are over 100000000000000000. Now attempting to list a collection without .where('fieldId', '==', someId) is rejected.

Upvotes: 1

Frank van Puffelen
Frank van Puffelen

Reputation: 599601

The only way I can think of is with query based rules.

Something like this:

allow read: if resource.fieldId.published == 123456;

But I don't think there's a way to only require them to filter on fieldId, no matter what value.

Interestingly enough, this is possible with Realtime Database security rules, which have a separate clause for query.orderByChild.

I think this sounds like a reasonable feature though, so I recommend you file a feature request. It won't help you now or in any near feature, but... who knows. 🤞

Upvotes: 1

Related Questions