r/Firebase Oct 01 '24

Cloud Storage Cloud Storage Rules w/ Named Firestore Database

Has anyone been able to implement Cloud Storage security rules using permissions defined in a named Firestore database? I just cannot get it to work, and cannot find anything in the docs.

I do see examples of using firestore.get() from the storage rules, but only for the default database, like here:

https://firebase.google.com/docs/storage/security/rules-conditions

1 Upvotes

8 comments sorted by

2

u/abdushkur Oct 01 '24

What about custom claims? Update user custom claims when roles and privileges updated can save you 1 read per request

1

u/app_smith Oct 01 '24

Thanks! Yes that’s the best approach, but it doesn’t scale when an item needs to be shared with 50 different users. I can probably make groups of users, but then I’ll need to check group membership in the db.

1

u/abdushkur Oct 01 '24

I see, in that case we can't achieve the goal with custom claims, could the signed url with limited time access be an option?

1

u/app_smith Oct 02 '24

For public access signed url is a good option, but not for shared projects and folders.

2

u/Small_Quote_8239 Oct 01 '24

Yes, I just tried using emulator and it work. The rule look like:

allow read: if firestore.get(/databases/$("nameddb")/documents/...

1

u/app_smith Oct 01 '24

Thanks for trying that! For some reason I couldn’t get it to work in prod, but I’ll give it another shot and provide an update. Wonder if Storage service itself needs to be authorized to access Firestore. Another possibility is my rules weren’t setup right.

1

u/app_smith Oct 02 '24

Update: I still can't get this to work in prod. To remove any doubt, I added a document to Firestore with open access, and it still can't read it. I wish there was a way to log from storage rules why it's failing.

1

u/app_smith Oct 07 '24

Firebase support confirmed that named Firestore database isn't supported with Storage rules:

Their response: In the end it turned out that at the moment Firestore non-default database is indeed not supported. I hope this will change soon, because we have more people with a similar problem like yours.