I'm building an app with FlutterFlow that will be used by various companies. I'm having trouble setting up the security rules for an app that will be used by various companies. My environment is: FlutterFlow+Firebase

I'm managing all data using reference types instead of subcollections. Users who log in belong to a specific office of a company and can CRUD various data. I want users to be able to CRUD all data belonging to their company (allowing them to CRUD data across offices within their company). My data structure is as follows:

• Companies

  • name

• Offices

  • name
  • ref_company

• Users

  • name
  • ref_company
  • ref_office

• Data
  value

  • ref_company
  • ref_office
  • created_by (User reference)

This way, I'm managing which company and which office each piece of data belongs to. For security, I want to allow logged-in users to CRUD data across offices, but only within their own company. I set up the following security rules:

function isAuthenticated() { 
  return request.auth != null; 
}

// Function to get user document
function getUserData() {
  return get(/databases/$(database)/documents/users/$(request.auth.uid)).data;
}

// Function to get user's company ID
function getUserCompanyId() {
  return getUserData().ref_company;
}

// Check if resource company ID matches user's company ID
function isSameCompany(resourceData) { 
  return isAuthenticated() && 
         resourceData.ref_company != null && 
         resourceData.ref_company == getUserCompanyId(); 
}

// Check if request company ID matches user's company ID
function isSameCompanyInRequest(requestData) {
  return isAuthenticated() && 
         requestData.ref_company != null &&
         requestData.ref_company == getUserCompanyId();
}

match /data/{document} {
  allow get: if isSameCompany(resource.data);
  allow list: if isSameCompany(resource.data);
  allow create: if isSameCompanyInRequest(request.resource.data);
  
  allow update: if isSameCompany(resource.data) && 
                   isSameCompanyInRequest(request.resource.data);
  
  allow delete: if isSameCompany(resource.data);
}

I can create, delete, and update data without problems, but when I try to view pages with ListView displaying data, I get an error and cannot read the data.

The error is:

Run mode-only notification: Firestore Security Rules Error on Container: Missing or insufficient permissions.

I changed the part allow list: if isSameCompany(resource.data); to allow list: if isAuthenticated(); and was able to read the data without any problems. However, this makes the security weaker, so I'd like to find a better solution.

I'm building an app with FlutterFlow that will be used by various companies. I'm having trouble setting up the security rules for an app that will be used by various companies. My environment is: FlutterFlow+Firebase

I'm managing all data using reference types instead of subcollections. Users who log in belong to a specific office of a company and can CRUD various data. I want users to be able to CRUD all data belonging to their company (allowing them to CRUD data across offices within their company). My data structure is as follows:

• Companies

  • name

• Offices

  • name
  • ref_company

• Users

  • name
  • ref_company
  • ref_office

• Data
  value

  • ref_company
  • ref_office
  • created_by (User reference)

This way, I'm managing which company and which office each piece of data belongs to. For security, I want to allow logged-in users to CRUD data across offices, but only within their own company. I set up the following security rules:

function isAuthenticated() { 
  return request.auth != null; 
}

// Function to get user document
function getUserData() {
  return get(/databases/$(database)/documents/users/$(request.auth.uid)).data;
}

// Function to get user's company ID
function getUserCompanyId() {
  return getUserData().ref_company;
}

// Check if resource company ID matches user's company ID
function isSameCompany(resourceData) { 
  return isAuthenticated() && 
         resourceData.ref_company != null && 
         resourceData.ref_company == getUserCompanyId(); 
}

// Check if request company ID matches user's company ID
function isSameCompanyInRequest(requestData) {
  return isAuthenticated() && 
         requestData.ref_company != null &&
         requestData.ref_company == getUserCompanyId();
}

match /data/{document} {
  allow get: if isSameCompany(resource.data);
  allow list: if isSameCompany(resource.data);
  allow create: if isSameCompanyInRequest(request.resource.data);
  
  allow update: if isSameCompany(resource.data) && 
                   isSameCompanyInRequest(request.resource.data);
  
  allow delete: if isSameCompany(resource.data);
}

I can create, delete, and update data without problems, but when I try to view pages with ListView displaying data, I get an error and cannot read the data.

The error is:

Run mode-only notification: Firestore Security Rules Error on Container: Missing or insufficient permissions.

I changed the part allow list: if isSameCompany(resource.data); to allow list: if isAuthenticated(); and was able to read the data without any problems. However, this makes the security weaker, so I'd like to find a better solution.

• flutter
• firebase
• google-cloud-firestore
• firebase-security
• flutterflow

• The section being displayed in the ListView is the Data collection. The filter shows items where the logged-in user's ref_office matches the ref_office in the Data collection. – kenta_non_jp Commented Mar 21 at 1:51
• Please don't add additional info in a comment. Instead, click the little edit link under your question, and add it there. – Frank van Puffelen Commented Mar 21 at 15:12

1 Answer 1

It'd be good to see your query, but my guess is that you're hitting: Rules are not filters.

Firebase security rules don't actually inspect each potential document (as that wouldn't scale), but instead check the query against the rules to ensure the query only requests data that it is allowed to access.

So you'll need to filter for ref_company in your query too, not just in the rules.