I have two collections: one called user_registration that stores user data (phone, email, UID, etc.), and another called SlideShow with various fields. I want to allow deletion of any SlideShow document only if the requesting user is an admin, verified by checking their UID in the user_registration collection. I tried to create a rule that uses a UID field from the SlideShow document, but since that field isn’t present, it fails with permission errors.
I attempted to write my Firebase rules as follows:
match /SlideShow/{SlideShowId} {
allow read: if true;
allow write, update, delete: if get(/databases/$(database)/documents/user_registration/$(request.resource.data.Uid)).data.role == 'admin';
}
And here is the Flutter code I used:
Future deleteItem( ) async {
try {
DocumentSnapshot userDoc = await FirebaseFirestore.instance
.collection('user_registration')
.doc(Uid)
.get();
if (userDoc['role'] == 'admin') {
QuerySnapshot querySnapshot = await FirebaseFirestore.instance
.collection('SlideShow')
.where('IDSlideShow', isEqualTo: int.parse(widget.IDSlideShow))
.get();
for (DocumentSnapshot docSnapshot in querySnapshot.docs) {
await docSnapshot.reference.delete();
}
print('Documents deleted successfully.');
} else {
print('User does not have permission to delete.');
}
} catch (e) {
print('Error deleting documents: $e');
}
}
The error I receive is:
W/Firestore( 6815): (25.1.1) [WriteStream]: (9d81ab6) Stream closed with status: Status{code=PERMISSION_DENIED, description=Missing or insufficient permissions., cause=null}.
W/Firestore( 6815): (25.1.1) [Firestore]: Write failed at SlideShow/tfo1LvgdtZYOEVLawm1k: Status{code=PERMISSION_DENIED, description=Missing or insufficient permissions., cause=null}
I/flutter ( 6815): Error deleting documents: [cloud_firestore/permission-denied] The caller does not have permission to execute the specified operation.
I did not add a UID to the SlideShow documents because I want a user to have the ability to delete any document they choose after verifying their admin role. How can I fix these rules so that the deletion works correctly?