Handling sign-out from Firebase without getting permission errors - firebase

Question

In my Angular/Firebase app, I have a user service which supports sign-in and sign-out. After sign-in, I retrieve app-specific data for the user from my Angular database. The service publishes an observable called appUser$ which contains the current user object (or null, if no-one is signed in). Things look like this. I'm using switchMap to switch between different observables for my app's user data as users sign in and sign out.
constructor(
private angularFireAuth: AngularFireAuth,
private angularFireDatabase: AngularFireDatabase
) {
this.appUser$ = this.angularFireAuth.authState
.map(user => user && user.uid)
.switchMap(uid => uid ? this.angularFireDatabase.object(`/users/${uid}`) :
Observable.of(null);
}
signOut() { return this.angularFireAuth.auth.signOut(); }
The problem with this is that the instant sign-out occurs, the permissions for accessing the /users node in the database are lost, generating an permission denied run-time error. To deal with this, I tried creating my own Subject for Angular User and zero it out before calling signOut. I thought that this would trigger the switchMap and somehow cancel the pending object observable for the previous user's app data, thereby preventing the permission denied error.
user$: Subject;
constructor(
private angularFireAuth: AngularFireAuth,
private angularFireDatabase: AngularFireDatabase
) {
this.angularFireAuth.authState.subscribe(this.user$);
this.appUuser$ = this.user$
.map(user => user || user.uid)
.switchMap(uid => uid ? this.angularFireDatabase.object(`/users/${uid}`) :
Observable.of(null);
}
signOut() {
this.user$.next(null);
return this.angularFireAuth.auth.signOut();
}
But the same permission problem persists, even if I delay the call to signOut. It seems as if somehow the observable created by this.angularFireDatabase.object is somehow still "alive" even after the switchMap should have switched to the Observable.of(null), and Firebase is still unhappy about losing permissions to access it.
I could trap or suppress this error somehow, but is there some simple way to deal with this situation?