Search code examples
javascriptgoogle-cloud-firestorefirebase-securityangularfire

Firestore rules: Property is undefined on object. for 'list' @ L6


I am having an issue where I am trying to query a subquery by a field, and I have tried the emulator as well as firebase support (still on going, but not solutions yet).

When running the following query:

const queryByNumber = query(
  collectionGroup(this.firestore, 'residents'), 
  where('cellNumber', '==', number)
);
return from(getDocs(queryByNumber)); 

This query has the error of:

Property cellNumber is undefined on object. for 'list' @ L6

This is what the rules look like at the moment

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /{path=**}/residents/{residentDoc} {
        allow write: if resource.data.cellNumber == request.auth.token.phone_number;
        allow read: if request.auth.token.phone_number == resource.data.cellNumber;
        //allow read; //temp permission till support fix
      }
      match /Units/{unitNumber} {
        allow read: if request.auth != null;
        function residentDoc(residentId) {
            return get(/databases/$(database)/documents/Units/$(unitNumber)/residents/$(residentId))
        }
        
        match /pets/{petId} {
          allow write: if residentDoc(request.resource.data.residentId).data.cellNumber == request.auth.token.phone_number;
          allow read: if request.auth != null;
        }
      }
    }
}

And this is the firestore data structure at the moment:

firestore data structure

I have tried to change my query to have the array-contains in the where clause, but that doesn't change much.

Note: the allow read without the if check allows the data to be retrieved, so the query does work, just the rules to secure it are not`


Solution

  • The issue was another query trying to get all resident data after the initial one was fired, which caused it to fail the rule because the second one wasn't querying by cellNumber anymore. I have changed the rules to validate by UID since that will always be provided