已放开Firestore全读写权限仍遇[firestore/permission-denied]错误求助

环境与配置 #

基于React Native、Expo和React Native Firebase搭建项目，已在firestore.rules中配置允许所有读写操作：

rules_version = '2';

service cloud.firestore {
  match /databases/{database}/documents {
    match /{document=**} {
      allow read, write: if true;
    }
  }
}

触发问题的代码 #

调用以下添加数据的代码时触发权限拒绝错误：

export const addGearItem = async (
  data: IGearItem,
  user: FirebaseAuthTypes.User
): Promise<IGearItem> => {
  const serializedData = serializeGearItem(data);

  await firestore()
    .collection(COLLECTIONS.GEAR)
    .doc(user.uid)
    .collection(COLLECTIONS.ITEMS)
    .add(serializedData);

  return data;
};

遇到的错误 #

权限拒绝错误 #

Possible Unhandled Promise Rejection (id: 3):
Error: [firestore/permission-denied] The caller does not have permission to execute the specified operation.
NativeFirebaseError: [firestore/permission-denied] The caller does not have permission to execute the specified operation.
    at get (http://10.134.184.52:8081/node_modules/expo-router/entry.bundle//&platform=ios&dev=true&hot=false&lazy=true:244380:52)
    at ?anon_0_ (http://10.134.184.52:8081/src/services/firestoreService.bundle//&platform=ios&hot=false&lazy=true&dev=true&minify=false&modulesOnly=true&runModule=false&shallow=true:46:115)
    at next (native)
    at asyncGeneratorStep (http://10.134.184.52:8081/node_modules/expo-router/entry.bundle//&platform=ios&dev=true&hot=false&lazy=true:5991:26)
    at _next (http://10.134.184.52:8081/node_modules/expo-router/entry.bundle//&platform=ios&dev=true&hot=false&lazy=true:6010:29)
    at anonymous (http://10.134.184.52:8081/node_modules/expo-router/entry.bundle//&platform=ios&dev=true&hot=false&lazy=true:6015:14)
    at tryCallTwo (/Users/distiller/react-native/packages/react-native/sdks/hermes/build_iphonesimulator/lib/InternalBytecode/InternalBytecode.js:61:9)
    at doResolve (/Users/distiller/react-native/packages/react-native/sdks/hermes/build_iphonesimulator/lib/InternalBytecode/InternalBytecode.js:216:25)
    at Promise (/Users/distiller/react-native/packages/react-native/sdks/hermes/build_iphonesimulator/lib/InternalBytecode/InternalBytecode.js:82:14)
    at anonymous (http://10.134.184.52:8081/node_modules/expo-router/entry.bundle//&platform=ios&dev=true&hot=false&lazy=true:6007:25)
    at apply (native)

该问题在模拟器和生产环境中均存在。

服务不可用错误 #

后续测试简单查询时出现：

Possible Unhandled Promise Rejection (id: 0):
Error: [firestore/unavailable] The service is currently unavailable. This is a most likely a transient condition and may be corrected by retrying with a backoff.
NativeFirebaseError: [firestore/unavailable] The service is currently unavailable. This is a most likely a transient condition and may be corrected by retrying with a backoff.
    at get (http://10.134.184.52:8081/node_modules/expo-router/entry.bundle//&platform=ios&dev=true&hot=false&lazy=true:243038:50)
    at ?anon_0_ (http://10.134.184.52:8081/node_modules/expo-router/entry.bundle//&platform=ios&dev=true&hot=false&lazy=true:255640:86)
    at next (native)
    at asyncGeneratorStep (http://10.134.184.52:8081/node_modules/expo-router/entry.bundle//&platform=ios&dev=true&hot=false&lazy=true:5991:26)
    at _next (http://10.134.184.52:8081/node_modules/expo-router/entry.bundle//&platform=ios&dev=true&hot=false&lazy=true:6010:29)
    at anonymous (http://10.134.184.52:8081/node_modules/expo-router/entry.bundle//&platform=ios&dev=true&hot=false&lazy=true:6015:14)
    at tryCallTwo (/Users/distiller/react-native/packages/react-native/sdks/hermes/build_iphonesimulator/lib/InternalBytecode/InternalBytecode.js:61:9)
    at doResolve (/Users/distiller/react-native/packages/react-native/sdks/hermes/build_iphonesimulator/lib/InternalBytecode/InternalBytecode.js:216:25)
    at Promise (/Users/distiller/react-native/packages/react-native/sdks/hermes/build_iphonesimulator/lib/InternalBytecode/InternalBytecode.js:82:14)
    at anonymous (http://10.134.184.52:8081/node_modules/expo-router/entry.bundle//&platform=ios&dev=true&hot=false&lazy=true:6007:25)
    at apply (native)

排查与解决办法 #

针对权限拒绝问题 #

• 确认规则已发布生效：在Firebase控制台修改规则后必须点击「发布」按钮，本地修改的firestore.rules文件不会自动同步到云端，这是最常见的疏漏点。
• 校验用户对象有效性：检查传递给addGearItem的user对象是否合法，比如user.uid是否为空、用户是否处于登录状态。可以在调用前打印user.uid确认。
• 验证Firebase配置正确性：核对Expo项目中Firebase的配置参数（项目ID、API密钥、存储桶等）是否与Firebase控制台完全一致，配置错误会导致无法正常连接Firestore。
• 测试最简操作：暂时替换成无嵌套集合的简单写入，比如await firestore().collection('test').add({content: 'test'})，排除嵌套路径或集合名称错误的可能。

针对服务不可用问题 #

• 检查网络连接：确保模拟器/设备能正常访问外网，尝试切换网络环境（如WiFi转移动数据）测试，不稳定的网络会触发该临时错误。
• 添加重试逻辑：根据错误提示，这是临时状态，给Firestore操作添加重试机制。示例代码：

  const retryOperation = async (operation: () => Promise<any>, retries = 3, delay = 1000) => {
    try {
      return await operation();
    } catch (error) {
      if (retries > 0 && (error as any).code === 'firestore/unavailable') {
        await new Promise(resolve => setTimeout(resolve, delay));
        return retryOperation(operation, retries - 1, delay * 2);
      }
      throw error;
    }
  };
  
  // 使用方式
  await retryOperation(() => firestore()
    .collection(COLLECTIONS.GEAR)
    .doc(user.uid)
    .collection(COLLECTIONS.ITEMS)
    .add(serializedData));
  

• 清除缓存并重启：执行expo r -c清除Expo项目缓存，重启模拟器/设备后重新构建项目，缓存异常可能导致连接问题。
• 检查Firebase服务状态：在Firebase控制台查看项目所属区域的Firestore服务是否正常运行，确认无官方服务故障。

内容的提问来源于stack exchange，提问作者Christopher Flodin