I have 4 firestore collections:
users/{userId}
which I allow access only for the same use -request.auth.uid == userId
organizations/{organizationId}
which I allow access for users of that organization -exists(/databases/$(database)/documents/organizations/{organizationId}/users/$(request.auth.uid))
So far, easy rules. The following collections have references to either a user, or an organization, and best case scenario I would like to just tell firestore: hasAccess(someReference, read)
.
notifications
which have aref
for who to notify, which can be eitherusers/{userId}
ororganizations/{organizationId}
which I allow access if it is a reference to the user or to an organization the user is a member of (a combination of the previous two rules)accounts
which have an array of organizationref
, and I would like the rule to be like:resource.data.organizations.any(organization => hasAccess(organizationRef, read))
Questions:
- Is there a way to ask firebase to match the new reference and return if the user has access to it?
- Is there a way to treat an array like in my 4th collection, where I want to have an "any" operation?
Edit:
It is recursive because I want when a collection is matched, to ask about another collection rules, which can ask about another, etc.. (hasAccess
)
Edit 2:
One workaround is to make a function canAccess
which I can call recursively, such that for any path I can do canAccess(request.path);
.
BUT "Error saving rules - Line 5: Recursive call is not allowed."