Firebase Firestore集合组查询出现权限错误的排查请求

数据架构 #

products_clone (collection)
    |
    |-- productId_1 (document)
    |     |-- idStore: "StoreID_1"
    |     |-- productName: "Product Name 1"
    |     |-- is_exist: true
    |     |-- category: "Category 1"
    |     |-- // other product details
    |     |
    |     |-- prices (subcollection)
    |           |
    |           |-- priceId_1 (document)
    |           |     |-- storeName: "Store Name A"
    |           |     |-- price: 10.5
    |           |     |-- // other price details
    |           |
    |           |-- priceId_2 (document)
    |                 |-- storeName: "Store Name B"
    |                 |-- price: 8.99
    |                 |-- // other price details
    |
    |-- productId_2 (document)
    |     |-- idStore: "StoreID_2"
    |     |-- productName: "Product Name 2"
    |     |-- is_exist: false
    |     |-- category: "Category 2"
    |     |-- // other product details
    |     |
    |     |-- prices (subcollection)
    |           |
    |           |-- priceId_3 (document)
    |           |     |-- storeName: "Cool Store"
    |           |     |-- price: 7.25
    |           |     |-- // other price details
    |           |
    |           |-- priceId_4 (document)
    |                 |-- storeName: "Store Name D"
    |                 |-- price: 9.75
    |                 |-- // other price details
    |
    |-- // more products

问题现象 #

调用collectionGroup查询prices子集合时，触发权限错误：

Status{code=PERMISSION_DENIED, description=Missing or insufficient permissions., cause=null}

查询代码 #

Future<void> rankStoresByPriceTotal() async {
      try {
         QuerySnapshot productPricesSnapshot = await _fireStore
          .collectionGroup('prices')
          .where('storeName', isEqualTo: "Cool Store")
          .get();

      productPricesSnapshot.docs.forEach((priceSnapshot) {
          print(priceSnapshot['price']);
      });
    } catch (e) {
      print('Error ranking stores: $e');
    }
}

已尝试的安全规则 #

规则一 #

// Allow read access to the products_clone collection
match /products_clone/{document} {
  allow create: if true;
  allow read: if true;
  allow write: if true;
  allow delete: if true;
  
// Allow write access to the prices subcollection within the products_clone document
  match  /prices/{priceId} {
    allow read, write, create, delete: if true;
  }
}

规则二 #

// Allow read access to the prices subcollection within the products_clone collection
match /products_clone/{document}/prices/{priceId} {
  allow read, write, create, delete: if true;
}

原因分析与解决方案 #

collectionGroup查询会匹配所有同名的prices子集合，Firestore安全规则要求必须针对子集合名称编写顶层匹配规则，嵌套在父集合下的规则无法被collectionGroup查询识别。

正确的规则配置 #

使用通配符匹配所有路径下的prices子集合：

match /{path=**}/prices/{priceId} {
  allow read, write, create, delete: if true;
}

或者更精准地限制父集合为products_clone：

match /products_clone/{productId}/prices/{priceId} {
  allow read, write, create, delete: if true;
}

额外注意事项 #

• 规则部署后需等待1-2分钟生效，不要立即测试
• 确保项目无全局规则冲突
• 生产环境请替换if true为实际权限验证逻辑（如request.auth != null）

内容的提问来源于stack exchange，提问作者Rahul Gohil