I try to make manual rules I have two collection one to save data of user like phone , email ...ect name (user_registration) and other collection name SlideShow have also many of field data. So now what I try to do I need make some rules like If user need make delete data from SlideShow colleection frist by firebase rules check if this user is available in collection user_registration by field name (Uid) and if he has the rules of the (admin) by field name role.
I try to make it like this:
match /SlideShow/{SlideShowId} {
allow read: if true;
allow write, update, delete: if get(/databases/$(database)/documents/user_registration/$(request.resource.data.Uid)).data.role == 'admin';
}
and flutter code:
Future deleteItem( ) async {
try {
DocumentSnapshot userDoc = await FirebaseFirestore.instance
.collection('user_registration')
.doc(Uid)
.get();
if (userDoc['role'] == 'admin') {
QuerySnapshot querySnapshot = await FirebaseFirestore.instance
.collection('SlideShow')
.where('IDSlideShow', isEqualTo: int.parse(widget.IDSlideShow))
.get();
for (DocumentSnapshot docSnapshot in querySnapshot.docs) {
await docSnapshot.reference.delete();
}
print('Documents deleted successfully.');
} else {
print('User does not have permission to delete.');
}
} catch (e) {
print('Error deleting documents: $e');
}
}
but i get ervey time this error:
W/Firestore( 6815): (25.1.1) [WriteStream]: (9d81ab6) Stream closed with status: Status{code=PERMISSION_DENIED, description=Missing or insufficient permissions., cause=null}.
W/Firestore( 6815): (25.1.1) [Firestore]: Write failed at SlideShow/tfo1LvgdtZYOEVLawm1k: Status{code=PERMISSION_DENIED, description=Missing or insufficient permissions., cause=null}
I/flutter ( 6815): Error deleting documents: [cloud_firestore/permission-denied] The caller does not have permission to execute the specified operation.
this is image of (user_registration) collection
and image of (SlideShow) collection
I did not add uid to SlideShow I need make user can delete any document he want.
So any one have solve to this problem?
The request.resource.data.Uid
in your rule takes the value of the Uid
field in the resource as it exists after the operation is completed (assuming it is allowed).
Your SlideShow
document doesn't have a Uid
field, which is what your rule uses to determine the document to read from the user_registration
collection. Since the field doesn't exist, this rule fails and the write is rejected.
If you want to use the user_registration
document for the currently signed in user, the expression for that is:
request.auth.uid
I recommend keeping the Firebase documentation on accessing authentication data in security rules handy while you're working on this.
If you actually ever do need a field from the document in a delete
rule, make sure to use the resource
instead of request.resource
. The latter is the document as it exists after the operation is completed (assuming it is allowed), which in the case of a delete
operation means it'll be no document.