dart Firebase实时数据库:由于安全规则,无法读取或写入节点

agxfikkp  于 2023-07-31  发布在  其他
关注(0)|答案(1)|浏览(77)

我为我的“聊天”节点设置了这些规则,但我的Flutter应用程序无法读取或写入它。我仔细检查了“members”节点中是否写入了正确的auth.uid值。不知道发生了什么事

{
  "rules": {
    "appName": {    
        "groups": {
          "$groupID": {
            "chats": { /// Properties: uid, username, timestamp, text, type
            /// Users must be a member of the groupID to read and write to the "chats" node
            ".read": "root.child('groups/' + $groupID + '/members/' + auth.uid).exists()",
            ".write": "root.child('groups/' + $groupID + '/members/' + auth.uid).exists() && newData.hasChildren(['uid', 'username', 'timestamp', 'text', 'type'])"
            }
            "members":...
          },
        },
    }       
  }
}

字符串

插入数据:

//Save a single message to RTDB
  void saveMessage({required ModelChatData message, required String groupID}) async {
    await globals.userGlobals(); //Required if using globals

    final rtdbGroupChatPath = 'appName/groups/QSsAJCSZqBuzGQo948G1/chats';
    final rtdbGroupChatRef = FirebaseDatabase.instance.ref().child(rtdbGroupChatPath);
    rtdbGroupChatRef.push().set(message.toJson());
  }

阅读:

void getChatListener() async {
    await globals.userGlobals(); //Required if using globals
    final node = 'appName/groups/QSsAJCSZqBuzGQo948G1/chats';

    _groupChatRef = FirebaseDatabase.instance.ref(node);

    _chatsSubscription = _groupChatRef.onValue.listen((DatabaseEvent event) {
      dataList = [];

      for (final child in event.snapshot.children) {
        dataList.add(child.value);
      }

      setState(() {
        chats = dataList;
      });

    });
  }

节点(appName节点在group上面放不下,但确实有):

x1c 0d1x的数据

错误:

未处理异常:[firebase_database/permission-denied]客户端没有访问所需数据的权限。

规则的当前状态(在回答/评论中提出建议之后):

{ 
    "rules": {  
        "appName": {
            "groups": { 
                "$groupID": {
                    "members": { /// Properties: uid, username, addedTimestamp
                        /// Users must be a member of the groupID to read and write to the "chats" node
                        ".read": "root.child('appName/groups/' + $groupID + '/members/' + auth.uid).exists()",

                        /// Only allow reads from RTDB (except chats). Handle any modifications to it via Firestore triggers/cloud functions
                        ".write": false
                    },
                    "chats": { /// Properties: uid, username, timestamp, text, type
                        /// Users must be a member of the groupID to read and write to the "chats" node
                        ".read": "root.child('appName/groups/' + $groupID + '/members/' + auth.uid).exists()",
                        "$msgID": {
                            ".write": "root.child('appName/groups/' + $groupID + '/members/' + auth.uid).exists() && newData.hasChildren(['uid', 'username', 'timestamp', 'text', 'type'])"
                        }
                        
                    }
                },
            },
        }
    }
}

pkwftd7m

pkwftd7m1#

看起来您的.write规则(newData.hasChildren(['uid', 'username', 'timestamp', 'text', 'type']))验证的是单个聊天消息,而不是组的整个chat节点。这意味着你必须将它移动到规则JSON的更深一层:

"chats": {
  "$messageid": {
    ".write": "root.child('appName/groups/' + $groupID + '/members/' + auth.uid).exists() && newData.hasChildren(['uid', 'username', 'timestamp', 'text', 'type'])"
  }

字符串

相关问题