I have 4 firestore collections:
users/{userId}which I allow access only for the same use -request.auth.uid == userIdorganizations/{organizationId}which I allow access for users of that organization -exists(/databases/$(database)/documents/organizations/{organizationId}/users/$(request.auth.uid))
So far, easy rules. The following collections have references to either a user, or an organization, and best case scenario I would like to just tell firestore: hasAccess(someReference, read).
notificationswhich have areffor who to notify, which can be eitherusers/{userId}ororganizations/{organizationId}which I allow access if it is a reference to the user or to an organization the user is a member of (a combination of the previous two rules)accountswhich have an array of organizationref, and I would like the rule to be like:resource.data.organizations.any(organization => hasAccess(organizationRef, read))
Questions:
- Is there a way to ask firebase to match the new reference and return if the user has access to it?
- Is there a way to treat an array like in my 4th collection, where I want to have an "any" operation?
Edit:
It is recursive because I want when a collection is matched, to ask about another collection rules, which can ask about another, etc.. (hasAccess)
Edit 2:
One workaround is to make a function canAccess which I can call recursively, such that for any path I can do canAccess(request.path);.
BUT "Error saving rules - Line 5: Recursive call is not allowed."