What I am trying to achieve is very simple. I need to create a user entry in the database only if it doesn't exist.
The app flow:
The client code (create operation):
this.db.doc('users/' + uid).set({username: Santa})
The firestore rules:
service cloud.firestore {
match /databases/{database}/documents {
match /users/{uid} {
allow create: if
request.auth != null &&
request.auth.uid == uid &&
!exists(/databases/$(database)/documents/users/$(uid));
allow update: if request.auth != null && request.auth.uid == uid;
}
}
}
Additional info:
As you may already know the code doesn't work. Everytime I run the client-side code the current user is completely replaced with a new document. However, if I delete the following line from the rules everything works as expected:
allow update: if request.auth != null && request.auth.uid == uid;
But now the question arises, how do I secure data inside user document from unauthorised modifications? Any advice?
Use logic in your code, but not in rules. Add addOnCompleteListener to user collection and after get the result do some actions.
getUsers.document(userUID).get().addOnCompleteListener(new OnCompleteListener<DocumentSnapshot>() {
@Override
public void onComplete(@NonNull Task<DocumentSnapshot> doc) {
if(!doc.getResult().exists()){
//add new user
}
}
}
Rules:
match /UsersProfile/{document=**} {
allow read, write: if request.auth != null;
}
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With