How to debug Firestore security rules in Flutter - firebase

Question

I'm writing my first app in Flutter and got stuck with the Firestore security rules. I can allow write & read and everything works fine, but if I want to limit adding of objects to users who have an account, things break.
More specifcally I have the following rules:
match /ratings/{anyRatingFile=**} {
allow create: if request.auth.uid == get(/databases/$(database)/documents/$(request.resource.data.user)).id;
}
Basically, if the user ID from the request exists, then I will accept the creating request. I can use the online simulator and it works! If the UID is not registered I get rejected and otherwise the request is accepted. But when I try to create an object in my flutter App, it always crashes with the following stack trace:
W/Firestore(30727): (19.0.0) [Firestore]: Write failed at ratings/48MZwRY66G13g8T0Nl8j: Status{code=PERMISSION_DENIED, description=Missing or insufficient permissions., cause=null}
E/flutter (30727): [ERROR:flutter/lib/ui/ui_dart_state.cc(148)] Unhandled Exception: PlatformException(Error performing setData, PERMISSION_DENIED: Missing or insufficient permissions., null)
E/flutter (30727): #0 StandardMethodCodec.decodeEnvelope (package:flutter/src/services/message_codecs.dart:564:7)
E/flutter (30727): #1 MethodChannel.invokeMethod (package:flutter/src/services/platform_channel.dart:316:33)
E/flutter (30727): <asynchronous suspension>
E/flutter (30727): #2 DocumentReference.setData (package:cloud_firestore/src/document_reference.dart:51:30)
E/flutter (30727): #3 CollectionReference.add (package:cloud_firestore/src/collection_reference.dart:58:23)
E/flutter (30727): <asynchronous suspension>
E/flutter (30727): #4 MyApp.submitRating (package:MyApp/screens/myscreen.dart:128:16)
E/flutter (30727): #5 MyApp._buildMain.<anonymous closure> (package:MyApp/screens/myscreen.dart:93:24)
E/flutter (30727): #6 _InkResponseState._handleTap (package:flutter/src/material/ink_well.dart:635:14)
E/flutter (30727): #7 _InkResponseState.build.<anonymous closure> (package:flutter/src/material/ink_well.dart:711:32)
E/flutter (30727): #8 GestureRecognizer.invokeCallback (package:flutter/src/gestures/recognizer.dart:182:24)
E/flutter (30727): #9 TapGestureRecognizer._checkUp (package:flutter/src/gestures/tap.dart:365:11)
E/flutter (30727): #10 TapGestureRecognizer.handlePrimaryPointer (package:flutter/src/gestures/tap.dart:275:7)
E/flutter (30727): #11 PrimaryPointerGestureRecognizer.handleEvent (package:flutter/src/gestures/recognizer.dart:455:9)
E/flutter (30727): #12 PointerRouter._dispatch (package:flutter/src/gestures/pointer_router.dart:75:13)
E/flutter (30727): #13 PointerRouter.route (package:flutter/src/gestures/pointer_router.dart:102:11)
E/flutter (30727): #14 _WidgetsFlutterBinding&BindingBase&GestureBinding.handleEvent (package:flutter/src/gestures/binding.dart:218:19)
E/flutter (30727): #15 _WidgetsFlutterBinding&BindingBase&GestureBinding.dispatchEvent (package:flutter/src/gestures/binding.dart:198:22)
E/flutter (30727): #16 _WidgetsFlutterBinding&BindingBase&GestureBinding._handlePointerEvent (package:flutter/src/gestures/binding.dart:156:7)
E/flutter (30727): #17 _WidgetsFlutterBinding&BindingBase&GestureBinding._flushPointerEventQueue (package:flutter/src/gestures/binding.dart:102:7)
E/flutter (30727): #18 _WidgetsFlutterBinding&BindingBase&GestureBinding._handlePointerDataPacket (package:flutter/src/gestures/binding.dart:86:7)
E/flutter (30727): #19 _rootRunUnary (dart:async/zone.dart:1136:13)
E/flutter (30727): #20 _CustomZone.runUnary (dart:async/zone.dart:1029:19)
E/flutter (30727): #21 _CustomZone.runUnaryGuarded (dart:async/zone.dart:931:7)
E/flutter (30727): #22 _invoke1 (dart:ui/hooks.dart:250:10)
E/flutter (30727): #23 _dispatchPointerDataPacket (dart:ui/hooks.dart:159:5)
and per request, here is the code:
var collection = Firestore.instance.collection('ratings');
collection.add({
"puzzle": "/sample/" + ID,
"user": "/users/" + appState.user.uid,
"rating": rating,
});
And a bit more debug info. This request on the firestore website works, e.g. return "Simulated write allowed".
{"__name__":"/databases/(default)/documents/ratings/test","id":"test","data":{"user":"/users/PCAE2"}}
Authentication Payload:
{
"uid": "PCAE2",
"token": {
"sub": "PCAE2",
"aud": "myApp-1",
"email": "",
"email_verified": false,
"phone_number": "",
"name": "",
"firebase": {
"sign_in_provider": "google.com"
}
}
}
I cut out most of the user ID for anonymity, but otherwise it is a copy-paste. And in my local log I see the following message:
W/BiChannelGoogleApi(30727): [FirebaseAuth: ] getGoogleApiForMethod() returned Gms: com.google.firebase.auth.api.internal.zzaq#9304ffb
D/FirebaseAuth(30727): Notifying id token listeners about user ( PCAE2 ).
I/flutter (30727): Logged in
So two questions:
1) What is the issue here?
2) How do I debug this sort of errors? I tried to find some Firestore log files, but couldn't find any. I can see that I can write unit tests, but the test on the website doesn't help because it passes.
Thank you for your help!

Answer 1

I solved my particular problem, but I still don't know how to debug this in general. So if you know, please let me know.
The issue here was another rule:
match /users/{userId}/{anyUserFile=**} {
allow read, write, delete: if request.auth.uid == userId
}
My mistake, that I did not include that in the question, but I assumed it would not have been a problem because the simulation works. Anyway, removing this line and allowing read & write for everybody in the world to the /users/ table fixes the problem.
This opens up a list of new questions though:
Why did the simulation work, but not my flutter App request?
How can I protect the /users/ table?
How do I debug things like this in the future, if the simulator differs from the app behavior?
Thanks!

Answer 2

Firebase security rules cannot be debugged. But, surely you can validate the rules via a simulator
Example