check for absent field with firestore security rules - google-cloud-firestore

Question

I am running a cloud function triggered by an onCreate event. This function required the userID, so after reading this post:
https://stackoverflow.com/a/50842161/4484332
.. i am passing the userId in the created document.
The cloud function is then deleting the userId field.
Now, since I read that it can take up to 10s for the cloud function to run, I want to make sure that the document is not queried before userId is deleted.
function isAdmin(){
return request.auth.uid == "***(admin's uid)***"
}
match /messages/{message} {
allow create: if request.auth.uid != null &&
(isNewMessage(request.resource.data)||isAdmin()) &&
userExists() && (matchesParent()||isFirstChild()||isSeed()||isAdmin());
allow read: if resource.data.userId == null || resource.data.userId == request.auth.uid
allow update: if isAdmin();
allow delete: if isAdmin();
}
The problem is the allow readline: I get FirebaseError:
Property userId is undefined on object.
Client query:
await db
.collection("messages")
.where("subcategoryId", "==", subcategorie)
.where("rank", "==", 0)
.orderBy(value, order)
.limit(paginationNumber)
.startAfter(last)
.get();
Edit: Rules are not filters and it looks like it is what I am trying to do..
Maybe the whole approach to this problem is wrong and my mistake is that I use the firebase authentication uid as document id for each user in the 'users' collection, including the admin user. So I am reluctant in having the admin's uid out there for 10s before the cloud function deletes the userId field..

Answer 1

What you're trying to do isn't possible because security rules are not filters. Please read that documentation carefully - your rule is apparently trying to be a filter.
Security rules can't filter out documents from a query. Either the query returns all of the matching documents, or it generates an error. The query must specify its own filters, and those filters must match what is required by the rules.
If you want to use resource.data in a rule, that can only work for individual document get(), but never for queries.

Answer 2

1) Instead of having your Cloud Function deleting the field, just set it to a dummy value meaning it has been removed.
2) Add a condition on the userid in your where statement, in addition to the rules
await db
.collection("messages")
.where("userid", "==", 0) // Dummy value, use whatever that will never match a real userid
.where("subcategoryId", "==", subcategorie)
.where("rank", "==", 0)
.orderBy(value, order)
.limit(paginationNumber)
.startAfter(last)
.get();
You have to use a dummy value because Firestore does not allow to filter for something that does not exist