Problem with write in subcollections Firestore Rules - firebase

Question

I have a Firestore database and has the following structure:
collection (teachers): {
doc (id): {
name: name
lastName: lastName
collection (classes): {
doc (id): {
name: math
}
}
}
}
What I'm trying to achieve is that the headmaster is able to get the teacher's name and add/create some classes for the very same teacher. The problem comes with adding the Firestore rules. I've tried this three rule possibilities, but none worked as expected. I was able to read, but no writing was possible.
1
service cloud.firestore {
match /databases/{database}/documents {
match /teachers/{teacher} {
allow get if true;
allow create if true;
}
}
}
2
service cloud.firestore {
match /databases/{database}/documents {
match /teachers/{teacher} {
allow get if true;
}
match /teachers/{teacher}/classes/{class} {
allow create if true;
}
}
3
service cloud.firestore {
match /databases/{database}/documents {
match /teachers/{teacher} {
allow get if true;
match /classes/{class} {
allow create if true;
}
}
}
I'm working with angularfirestore2, by the way.

Answer 1

What I get from your question is that, you want to give read, write for /teachers/{teacher}/classes/{class} to some users with headmaster role.
For that, first you need to check which users are headmasters.
If your teachers doc id is same as userid created in firebase auth, you can add a data field to your teacher document named isHM and set this to true, if user is headmaster:
collection (teachers): {
doc (id): {
name: name
lastName: lastName
isHM: true
collection (classes): {
doc (id): {
name: math
}
}
}
}
Now add the following rule:
service cloud.firestore {
match /databases/{database}/documents {
match /teachers/{teacher}/classes/{class} {
function isHeadMaster() {
return get(/databases/$(database)/documents/teachers/$(request.auth.uid)).data.isHM;
}
// HM can read, write classes
allow read, write: if isHeadMaster == true;
}
}
}
or else you need to create a different collection with firebase userid as the doc id and add isHM field if the user is headmaster, as follows:
collection (headmasters): {
doc (uid): {
----
isHM: true
----
}
}
and then add following rule:
service cloud.firestore {
match /databases/{database}/documents {
match /teachers/{teacher}/classes/{class} {
function isHeadMaster() {
return get(/databases/$(database)/documents/headmasters/$(request.auth.uid)).data.isHM;
}
// HM can read, write classes
allow read, write: if isHeadMaster == true;
}
}
}
To find more role based access rules, check this https://firebase.google.com/docs/firestore/solutions/role-based-access