Styjun

I'm defining rules for my firestore database and i stuck there.
I have an post collection and an userProfile collection. If a user banned you you can't reach his post. You can reach which user shared the post under 'document/user'

So I try this command but not worked. When i simulate it every one get reject.

match /posts/currentDocument 
 allow read: if !exists(
 /databases/$(database)/documents/userProfile/$(request.auth.uid)/banned/
 $(/databases/$(database)/documents/posts/$(currentDocument)/user)
 )

So I wantto accept everyone's read request except banned users.

It depends on how you're trying to read from the collection.

If you're trying to read a specific document (e.g. /posts/post123) that is not from a banned user, the read should work. And if you're trying to read a specific document from a banned user, the read should be rejected.

If you're trying to read the entire /posts collection, that will indeed fail with the above security rules. The reason for that is that security rules don't filter your data; they merely ensure that the read operation only tries to read data that it's authorized for. And reading all of /posts is not authorized, since there are certain documents that are not readable.

To read all posts from unbanned users, you'll need to attach a listener that only tried to read those documents. In pseudo-code that would be something like:

db.collection('posts').where('user', 'not in', '/bannedusers')

But this unfortunately isn't possible in Firestore since it'd require a server-side join, which would make it impossible for Firestore to meet its performance guarantees.

But say for example that you have an approval flow, where each post needs to be approved before it can be read by other users. In that case you could enforce this in your security rules with:

// anyone can read approved posts, but only the author can read unapproved posts
allow read: if resource.data.approved == true || request.auth.uid == resource.data.author

And then query for only approved posts with:

db.collection("posts").where("approved", "==", true).get()

In this last example, the security rules can validate that the query only requests posts that they have access to, so it allows the query.

For more on this, see:

• The Firestore documentation on securing queries
  


• The video series Getting to know Cloud Firestore, specifically the [episode on security rules](Getting to know Cloud Firestore)