Access to Firebase Storage in Flutter

Question

I'm fairly new to Flutter and haven't ever used Firebase before so my aplogies if there is an obvious solution to this.

I'm working on a Flutter app which involves recording form submissions and submitting them to a central location.

Firebase Storage seemed like a good fit since as I understood it the app can upload files to the cloud bucket and then they can be accessed through the Firebase console. Correct me if I'm wrong.

So I found this module for Flutter;
https://pub.dartlang.org/packages/firebase_storage

I used the example code as a basis.

once at the start of the code I call;

final FirebaseApp app = await FirebaseApp.configure(
  name: 'test',
  options: new FirebaseOptions(
    googleAppID: Platform.isIOS
        ? '{ios app id}'
        : '{android app ID}',
    gcmSenderID: '{project number code}',
    apiKey: '{web api key from the firebase console}',
    projectID: '{project ID}',
  ),
);
storage = new FirebaseStorage(
    app: app, storageBucket: '{address to data bucket}');

Then to upload a file I've tried;

final StorageReference ref =
storage.ref().child('uploads').child(filename);
final StorageUploadTask uploadTask = ref.putFile(
  file,
  new StorageMetadata(
    contentLanguage: 'en',
    customMetadata: <String, String>{'activity': 'submission'},
  ),
);


final Uri downloadUrl = (await uploadTask.future).downloadUrl;

final http.Response downloadData = await http.get(downloadUrl);
final String name = await ref.getName();
final String bucket = await ref.getBucket();
final String path = await ref.getPath();


return downloadData.statusCode >= 200 && 299 >= downloadData.statusCode;

and in the Firebase console I created the Uploads folder and I think set everything else up correctly.

My Firebase storage access rules look like this;

service firebase.storage {
  match /b/{bucket}/o {
    match /{allPaths=**} {
      allow read, write: if request.auth != null;
    }
  }
}

My issue is that when I try to upload the file I get the following error;

W/DynamiteModule(25832): Local module descriptor class for com.google.android.gms.firebasestorage not found.
I/DynamiteModule(25832): Considering local module com.google.android.gms.firebasestorage:0 and remote module com.google.android.gms.firebasestorage:6
I/DynamiteModule(25832): Selected remote version of com.google.android.gms.firebasestorage, version >= 6
W/System  (25832): ClassLoader referenced unknown path: /data/data/com.google.android.gms/app_chimera/m/00000040/n/armeabi-v7a
W/System  (25832): ClassLoader referenced unknown path: /data/data/com.google.android.gms/app_chimera/m/00000040/n/armeabi
E/StorageUtil(25832): error getting token java.util.concurrent.ExecutionException: com.google.firebase.internal.api.FirebaseNoSignedInUserException: Please sign in before trying to get a token.
W/NetworkRequest(25832): no auth token for request
E/StorageException(25832): StorageException has occurred.
E/StorageException(25832): User does not have permission to access this object.
E/StorageException(25832):  Code: -13021 HttpResult: 403
E/StorageException(25832): The server has terminated the upload session
E/StorageException(25832): java.io.IOException: The server has terminated the upload session
E/StorageException(25832):  at com.google.firebase.storage.UploadTask.zzs(Unknown Source)
E/StorageException(25832):  at com.google.firebase.storage.UploadTask.zzr(Unknown Source)
E/StorageException(25832):  at com.google.firebase.storage.UploadTask.run(Unknown Source)
E/StorageException(25832):  at com.google.firebase.storage.StorageTask.zzl(Unknown Source)
E/StorageException(25832):  at com.google.firebase.storage.zzq.run(Unknown Source)
E/StorageException(25832):  at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1113)
E/StorageException(25832):  at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:588)
E/StorageException(25832):  at java.lang.Thread.run(Thread.java:818)
E/StorageException(25832): Caused by: java.io.IOException: {  "error": {    "code": 403,    "message": "Permission denied. Could not perform this operation"  }}
E/StorageException(25832):  at bha.a(:com.google.android.gms.dynamite_dynamitemodulesc@[email protected] (040308-197041431):147)
E/StorageException(25832):  at bha.a(:com.google.android.gms.dynamite_dynamitemodulesc@[email protected] (040308-197041431):119)
E/StorageException(25832):  at bgu.onTransact(:com.google.android.gms.dynamite_dynamitemodulesc@[email protected] (040308-197041431):7)
E/StorageException(25832):  at android.os.Binder.transact(Binder.java:387)
E/StorageException(25832):  at com.google.android.gms.internal.firebase_storage.zza.transactAndReadExceptionReturnVoid(Unknown Source)
E/StorageException(25832):  at com.google.android.gms.internal.firebase_storage.zzm.zzf(Unknown Source)
E/StorageException(25832):  at com.google.android.gms.internal.firebase_storage.zzq.zza(Unknown Source)
E/StorageException(25832):  at com.google.android.gms.internal.firebase_storage.zzf.zza(Unknown Source)
E/StorageException(25832):  at com.google.firebase.storage.UploadTask.zzc(Unknown Source)
E/StorageException(25832):  ... 6 more
E/StorageException(25832): StorageException has occurred.
E/StorageException(25832): User does not have permission to access this object.
E/StorageException(25832):  Code: -13021 HttpResult: 403
E/StorageException(25832): The server has terminated the upload session
E/StorageException(25832): java.io.IOException: The server has terminated the upload session
E/StorageException(25832):  at com.google.firebase.storage.UploadTask.zzs(Unknown Source)
E/StorageException(25832):  at com.google.firebase.storage.UploadTask.zzr(Unknown Source)
E/StorageException(25832):  at com.google.firebase.storage.UploadTask.run(Unknown Source)
E/StorageException(25832):  at com.google.firebase.storage.StorageTask.zzl(Unknown Source)
E/StorageException(25832):  at com.google.firebase.storage.zzq.run(Unknown Source)
E/StorageException(25832):  at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1113)
E/StorageException(25832):  at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:588)
E/StorageException(25832):  at java.lang.Thread.run(Thread.java:818)
E/StorageException(25832): Caused by: java.io.IOException: {  "error": {    "code": 403,    "message": "Permission denied. Could not perform this operation"  }}
E/StorageException(25832):  at bha.a(:com.google.android.gms.dynamite_dynamitemodulesc@[email protected] (040308-197041431):147)
E/StorageException(25832):  at bha.a(:com.google.android.gms.dynamite_dynamitemodulesc@[email protected] (040308-197041431):119)
E/StorageException(25832):  at bgu.onTransact(:com.google.android.gms.dynamite_dynamitemodulesc@[email protected] (040308-197041431):7)
E/StorageException(25832):  at android.os.Binder.transact(Binder.java:387)
E/StorageException(25832):  at com.google.android.gms.internal.firebase_storage.zza.transactAndReadExceptionReturnVoid(Unknown Source)
E/StorageException(25832):  at com.google.android.gms.internal.firebase_storage.zzm.zzf(Unknown Source)
E/StorageException(25832):  at com.google.android.gms.internal.firebase_storage.zzq.zza(Unknown Source)
E/StorageException(25832):  at com.google.android.gms.internal.firebase_storage.zzf.zza(Unknown Source)
E/StorageException(25832):  at com.google.firebase.storage.UploadTask.zzc(Unknown Source)
E/StorageException(25832):  ... 6 more

Is it possible to log in with an app account (service account?) so individual users do not need to log in?

What am I doing wrong here?

Answer 1

Quoting from your StorageException:

User does not have permission to access this object.

This is what you would expect because your rules state the following:

allow read, write: if request.auth != null;

Firebase uses authentication.

There are two options to solve this:

• Either you authenticate your users with Firebase using the firebase_auth plugin

• Or you make your files publicly available by changing your rules to allow read, write;

The Storage Rules documentation contains information about integrating Firebase Authentication.