Firebase database security rule, check auth.email in resource.data

Question

Error [firebase.firestore] FirebaseError: Missing or insufficient permissions.

I have an object that a few users are allowed to update. An admin will set their email, and these users who sign in with those email will be allowed to update.

These are the rules that I have tried:

allow update: if request.resource.data.managerEmails.val().contains(request.auth.email) && request.resource.data.id == resource.data.id;

allow update: if request.resource.data.managerEmails.contains(request.auth.email) && request.resource.data.id == resource.data.id;

allow update: if request.resource.data.managerEmails.includes(request.auth.email) && request.resource.data.id == resource.data.id;

The resource to update:

{
  id: "someid",
  ...fields,
  managerEmails: "[email protected],[email protected]",
}

User auth who is updating:

{
  uid: "rSTLnYD9aisyZJHQPC6sg7mlsZh1",
  email: "[email protected]",
  ...
}

Update: Using request.auth.uid has been working in other rules, but in this case, I have to use emails because the users might not have signed up yet.

Using Rules Playground, I get Property email is undefined on object. Maybe using request.auth.email is not possible?

Answer 1

use: request.auth.token.email insted request.auth.email

documentation here