Firestore筛选权限不足问题排查（Ionic Cordova客户端）

Hey there! Let's dig into why you're hitting that Missing or insufficient permissions error when querying your designs collection by ownerId in your Ionic Cordova app. I've run into similar headaches before, so here are the most likely fixes to check out:

First up, make sure your rules are explicitly enforcing the ownerId check correctly. A common working setup for this scenario looks like this:

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /designs/{design} {
      // Allow read access only if the document's ownerId matches the authenticated user's UID
      allow read: if request.auth != null && request.auth.uid == resource.data.ownerId;
      // Adjust write rules to fit your app's needs
      allow write: if request.auth != null && request.auth.uid == resource.data.ownerId;
    }
  }
}

Key things to note here:

• request.auth != null ensures only logged-in users can access the data (skip this only if your app allows unauthenticated access, which is rare for owner-specific data)
• resource.data.ownerId refers directly to the ownerId field in each designs document—this must exactly match the logged-in user's UID (strings are case-sensitive!)

Firestore's security rules require your client query to explicitly match the rule's conditions. If you skip the ownerId filter, even if you plan to filter results later in code, Firestore will reject the request. Here's how to structure a valid query in Ionic:

Using AngularFire (common in Ionic apps) #

import { AngularFirestore } from '@angular/fire/compat/firestore';
import { AngularFireAuth } from '@angular/fire/compat/auth';

constructor(private firestore: AngularFirestore, private auth: AngularFireAuth) {}

async fetchMyDesigns() {
  const user = await this.auth.currentUser;
  
  // Critical: Make sure the user is authenticated first!
  if (!user) {
    console.error("User not logged in—this is a common permission error cause!");
    return;
  }

  try {
    // The where clause must exactly match the rule's condition
    const designsSnapshot = await this.firestore
      .collection('designs', ref => ref.where('ownerId', '==', user.uid))
      .get()
      .toPromise();

    designsSnapshot.forEach(doc => {
      console.log(`Design ${doc.id}:`, doc.data());
    });
  } catch (error) {
    console.error("Failed to fetch designs:", error);
  }
}

Using Vanilla Firebase SDK #

import { getFirestore, query, collection, where, getDocs } from "firebase/firestore";
import { getAuth, onAuthStateChanged } from "firebase/auth";

const db = getFirestore();
const auth = getAuth();

// Ensure user is authenticated before querying
onAuthStateChanged(auth, async (user) => {
  if (user) {
    try {
      const q = query(collection(db, "designs"), where("ownerId", "==", user.uid));
      const querySnapshot = await getDocs(q);
      
      querySnapshot.forEach((doc) => {
        console.log(`${doc.id} => ${doc.data()}`);
      });
    } catch (error) {
      console.error("Permission error:", error);
    }
  } else {
    console.error("No user logged in");
  }
});

• Case Sensitivity: Confirm the ownerId stored in your designs documents exactly matches the user's UID (Firebase UIDs are case-sensitive—"abc123" vs "ABC123" are treated as different values)
• Rule Deployment: Don't forget to click Publish in the Firebase Console after updating your rules! It's easy to make changes and forget to save them.
• Field Existence: Ensure every designs document actually has an ownerId field. If a document is missing this field, the rule will reject access to it.
• Emulator Testing: Use the Firestore Emulator to debug rules in real-time. You can enable it in your app with:

  import { getFirestore, connectFirestoreEmulator } from '@angular/fire/firestore';
  
  const firestore = getFirestore();
  connectFirestoreEmulator(firestore, 'localhost', 8080);
  

  The emulator will show you exactly why a request was denied, which is way faster than guessing.

To isolate whether the problem is with your query or rules, try fetching one specific designs document you know has the correct ownerId:

async testSingleDocument() {
  const user = await this.auth.currentUser;
  if (!user) return;

  const docRef = this.firestore.doc(`designs/your-known-document-id`);
  const doc = await docRef.get().toPromise();
  
  if (doc.exists) {
    console.log("Document data:", doc.data());
    console.log("Owner ID matches user UID?", doc.data().ownerId === user.uid);
  } else {
    console.log("Document not found");
  }
}

If this works but your collection query doesn't, your collection query is missing the ownerId filter. If this fails, double-check the document's ownerId or your rules.

内容的提问来源于stack exchange，提问作者rdethurens