Firestore Security Rules无字段级权限？是否有更优权限控制方案？

Great question—this is a super common pain point when working with Firestore Security Rules, especially when you need granular access across different user groups. Let’s break down your options beyond the nested private_values approach you already found:

1. Enforce Field Projection with Security Rules #

Firestore doesn’t let you filter fields directly in rules, but you can validate that clients only request fields they’re allowed to access using query projections.

First, have your client code use field-specific queries (e.g., in the Web SDK):

// Jane's client only requests allowed fields
db.collection('rooms').select('id', 'name', 'owner').get();

Then, add a rule that checks the requested fields match the allowed set for non-owners:

match /rooms/{roomId} {
  allow read: if request.auth != null &&
    // Owners can read all fields
    (resource.data.owner == request.auth.uid ||
     // Non-owners can only request id, name, owner
     request.query.projection.fields.hasOnly(['id', 'name', 'owner']));
}

This prevents clients from fetching restricted fields entirely, and keeps your document structure clean without nested objects.

2. Split Data into Separate Collections #

For scenarios where field permissions are drastically different (e.g., public vs. private data), split your data into two collections:

• rooms: Stores public fields (id, name, owner) with open read access for all authenticated users.
• room-private: Stores restricted fields (color) with rules that only allow the document owner to read/write.

Each document in room-private uses the same roomId as its counterpart in rooms. While this requires two separate queries to fetch full room data, it simplifies permission rules and scales well if you add more restricted fields later.

3. Use Custom Claims for Group-Based Field Access #

If you need to support multiple user groups with different field permissions (e.g., admins can see all fields, moderators can see some, regular users see only public), use Firebase Auth custom claims.

First, set a custom claim for a user group (via Firebase Admin SDK):

// Example: Grant an admin access to all fields
admin.auth().setCustomUserClaims(adminUid, { can_view_all_fields: true });

Then, update your rules to check these claims alongside field projections:

match /rooms/{roomId} {
  allow read: if request.auth != null &&
    (resource.data.owner == request.auth.uid ||
     request.auth.token.can_view_all_fields == true ||
     request.query.projection.fields.hasOnly(['id', 'name', 'owner']));
}

This lets you scale permissions to multiple groups without restructuring your data repeatedly.

Will This Force Bad Database Design? #

Short answer: No—it’s just adapting to Firestore’s strengths. NoSQL databases like Firestore encourage structuring data around your access patterns and permissions, rather than replicating relational database schemas. The approaches above are all intentional optimizations for Firestore’s model, not workarounds for "bad design."

The nested private_values approach you initially used is totally valid too—choose the method that best fits your app’s query patterns and permission complexity.

内容的提问来源于stack exchange，提问作者bgc