8.6.2 breaks auth/firestore rules

[mazlano27]

[REQUIRED] Describe your environment

• Operating System version: Mac OS X
• Browser version: Chrome
• Firebase SDK version: 8.6.2
• Firebase Product: auth

[REQUIRED] Describe the problem

After upgrading from firebase 8.6.1 → 8.6.2, I get the "ERROR FirebaseError: Missing or insufficient permissions." error when trying to access protected docs/collections. Rolling back to 8.6.1 fixes the issue.

Steps to reproduce:

Upgrade from Firebase 8.6.1 → 8.6.2
My app is running on Angular 12

[xylo04]

I can reproduce, I had to roll back k0swe/forester#395. Same symptom, ERROR FirebaseError: Missing or insufficient permissions appears in the JS console when trying to access documents. Rolling back fixes.

[looptheloop88]

Hi @mazlano27, I wasn't able to reproduce the error using the SDK version 8.6.2. Would you mind sharing a minimal, but complete sample project or code snippet that I can run locally to replicate the issue? Also, please include a sample Firestore security rules.

[glued]

I'm seeing this as well

[jsakas]

From 8.6.1 to 8.6.2 I see:

TypeError: t.onInit is not a function

I believe its related to auth as well.

[xylo04]

Hi @mazlano27, I wasn't able to reproduce the error using the SDK version 8.6.2. Would you mind sharing a minimal, but complete sample project or code snippet that I can run locally to replicate the issue? Also, please include a sample Firestore security rules.

I'm attempting to create a reproducible, minimal sample on Stackblitz, to no avail so far. Others, please feel free to fork it and see if we can isolate the issue.

[xylo04]

In the meantime, I have a reasonably simple reproduction with my real app:

1. Clone https://github.com/k0swe/forester
2. npm install
3. ng serve -o
4. Log in with a Google account
5. Create an empty logbook (any name)
6. You are taken to the logbook view. There should be no console errors about Firebase. (Might be some about websockets that I need to clean up)

Now to reproduce the undesired behavior:

1. npm install [email protected] --save-exact
2. ng serve -o
3. Back on the Forester main page, click on your logbook
4. On the logbook view, the console now has ERROR FirebaseError: Missing or insufficient permissions.

Now that I think of it, the security rules for this Firestore are such that the logbook collection is accessed by an array of editor IDs. Maybe the Firestore client is short-circuiting the security check when it can't tell if reading the logbook will succeed?

[lenanex]

I have the same issue on my side. I've downgraded to 8.6.1 and it solves the issue.

[Hibrix-net]

I couldn't write to Firestore. I've been fighting for hours thinking it was my fault.
I desperately found this thread. What a relief!

[steinv]

I have the same issue in my project. Hopefully there's a fix coming quickly. For now I pinned on an older version of firebase.

[strom2357]

Thanks for the repro app! I'll bring this up with the team, tracking internally at b/189114894

[jamesdaniels]

Perhaps related? angular/angularfire#2838

[Natreve]

Facing the same issue in firebase version 9 beta 2 as well it seems the only way to fix it is to basically have the security rules set to if true, which is a bad idea.

[Natreve]

apparently adding the outhstate listener fixes my issue in particular.

[jamesdaniels]

My guess would be that this is a "race-condition" due to how Firestore interacts with lazy-loaded Auth (per @angular/fire's current design), adding the authState listener or a route guard should ensure that the Angular component is loaded and auth initialized prior to Firestore usage. I wouldn't call that a work around, as it just decreases the likelihood that you experience this issue, if it is infact a race condition.

FWIW for v9 beta 2, we're taking a new approach in AngularFire (see 7.0.0-alpha.0) the main entries are no longer lazy-loaded, that will be entirely up to the developer now that we have tree-shaking. In the upcoming AngularFire 6.2 (angular/angularfire#2679) and 7.0.0-alpha.1 (compat) I'll have a proper work-around for lazy loaded auth+firestore, in that AngularFire will have lazy-loaded variant of AngularFirestore which will be able to force AngularFireAuth to be initialized prior to AngularFirestore (if it's being used).

[xylo04]

I'm still experiencing these symptoms as of v8.6.3 in k0swe/forester#412.

[RichardH9L]

My guess would be that this is a "race-condition" due to how Firestore interacts with lazy-loaded Auth (per @angular/fire's current design), adding the authState listener or a route guard should ensure that the Angular component is loaded and auth initialized prior to Firestore usage. I wouldn't call that a work around, as it just decreases the likelihood that you experience this issue, if it is infact a race condition.

FYI: I'm also experiencing this issue with v8.6.2 & v8.6.3. In my case the Firestore call is made from a lazy loaded module with a route guard. If it helps, I can share my repo with you @jamesdaniels

[mazlano27]

Still facing this issue is 8.6.5

[Auxx]

I'm getting the same error on any FireStore access attempt, but it ONLY happens in Chrome. Works fine in Firefox.

[mazlano27]

I'm having the same issue with v8.6.7 too. Rolling back to 8.6.1

[glued]

I'm also seeing this issue w/ @angular/fire and v8.6.7

[craigsheppard]

I was experiencing this issue before with 8.6.2, and I downgraded to 8.6.1 until this problem was resolved...

I've upgraded two Angular 12 projects to v8.6.7. The smaller project now works fine, however the (much) larger project still has the same errors, so there is definitely still a timing issue.

[schmidt-sebastian]

@mazlano27 / @glued / @craigsheppard Can you provide debug logs (via setLogLevel('debug'))? This should show us in what order components are initialized.

[schmidt-sebastian]

FYI - It looks like I might have messed up the fix. @Feiyang1 fixed a bug that is pending in #5023

[craigsheppard]

In case it's still needed:

[Log] [2021-06-15T14:02:33.793Z]  @firebase/firestore: – "Firestore (8.6.7): FirebaseCredentialsProvider" – "Auth not yet detected" (vendor.js, line 137223)
[Log] [2021-06-15T14:02:34.117Z]  @firebase/firestore: – "Firestore (8.6.7): FirestoreClient" – "Received user=" – "null" (vendor.js, line 137223)
[Log] [2021-06-15T14:02:34.117Z]  @firebase/firestore: – "Firestore (8.6.7): FirestoreClient" – "Using default OnlineComponentProvider" (vendor.js, line 137223)
[Log] [2021-06-15T14:02:34.118Z]  @firebase/firestore: – "Firestore (8.6.7): FirestoreClient" – "Using default OfflineComponentProvider" (vendor.js, line 137223)
[Log] [2021-06-15T14:02:34.118Z]  @firebase/firestore: – "Firestore (8.6.7): FirestoreClient" – "Initializing OfflineComponentProvider" (vendor.js, line 137223)
[Log] [2021-06-15T14:02:34.119Z]  @firebase/firestore: – "Firestore (8.6.7): FirestoreClient" – "Initializing OnlineComponentProvider" (vendor.js, line 137223)
[Log] [2021-06-15T14:02:34.121Z]  @firebase/firestore: – "Firestore (8.6.7): MemoryPersistence" – "Starting transaction:" – "Allocate target" (vendor.js, line 137223)
[Log] [2021-06-15T14:02:34.124Z]  @firebase/firestore: – "Firestore (8.6.7): MemoryPersistence" – "Starting transaction:" – "Execute query" (vendor.js, line 137223)
[Log] [2021-06-15T14:02:34.126Z]  @firebase/firestore: – "Firestore (8.6.7): QueryEngine" – "Using full collection scan to execute query:" – "Query(target=Target(users, filters: [uid == **REDACTED**, active == true], orderBy: [__name__ (asc)]); limitType=F)" (vendor.js, line 137223)
[Log] [2021-06-15T14:02:34.131Z]  @firebase/firestore: – "Firestore (8.6.7): Connection" – "Creating WebChannel: https://firestore.googleapis.com/google.firestore.v1.Firestore/Listen/channel" – "{\"httpSessionIdParam\":\"gsessionid\",\"initMessageHeaders\":{\"X-Goog-Api-Client\":\"gl-js…" (vendor.js, line 137223)
"{\"httpSessionIdParam\":\"gsessionid\",\"initMessageHeaders\":{\"X-Goog-Api-Client\":\"gl-js/ fire/8.6.7\",\"Content-Type\":\"text/plain\"},\"messageUrlParams\":{\"database\":\"projects/swell-marinas-dev/databases/(default)\"},\"sendRawJson\":true,\"supportsCrossDomainXhr\":true,\"internalChannelParams\":{\"forwardChannelRequestTimeoutMs\":600000},\"forceLongPolling\":false,\"detectBufferingProxy\":false,\"httpHeadersOverwriteParam\":\"$httpHeaders\"}"
[Log] [2021-06-15T14:02:34.309Z]  @firebase/firestore: – "Firestore (8.6.7): Connection" – "Opening WebChannel transport." (vendor.js, line 137223)
[Log] [2021-06-15T14:02:34.311Z]  @firebase/firestore: – "Firestore (8.6.7): Connection" – "WebChannel sending:" – "{\"database\":\"projects/swell-marinas-dev/databases/(default)\",\"addTarget\":{\"query\":{\"structuredQuery\":{\"from\":[{\"collectionId\":\"users\"}],\"whe…" (vendor.js, line 137223)
"{\"database\":\"projects/swell-marinas-dev/databases/(default)\",\"addTarget\":{\"query\":{\"structuredQuery\":{\"from\":[{\"collectionId\":\"users\"}],\"where\":{\"compositeFilter\":{\"op\":\"AND\",\"filters\":[{\"fieldFilter\":{\"field\":{\"fieldPath\":\"uid\"},\"op\":\"EQUAL\",\"value\":{\"stringValue\":\"**REDACTED**\"}}},{\"fieldFilter\":{\"field\":{\"fieldPath\":\"active\"},\"op\":\"EQUAL\",\"value\":{\"booleanValue\":true}}}]}},\"orderBy\":[{\"field\":{\"fieldPath\":\"__name__\"},\"direction\":\"ASCENDING\"}]},\"parent\":\"projects/swell-marinas-dev/databases/(default)/documents\"},\"targetId\":2}}"
[Log] [2021-06-15T14:02:34.427Z]  @firebase/firestore: – "Firestore (8.6.7): Connection" – "WebChannel transport opened." (vendor.js, line 137223)
[Log] [2021-06-15T14:02:34.498Z]  @firebase/firestore: – "Firestore (8.6.7): Connection" – "WebChannel received:" – "{\"targetChange\":{\"targetChangeType\":\"ADD\",\"targetIds\":[2]}}" (vendor.js, line 137223)
[Log] [2021-06-15T14:02:34.498Z]  @firebase/firestore: – "Firestore (8.6.7): Connection" – "WebChannel received:" – "{\"targetChange\":{\"targetChangeType\":\"REMOVE\",\"targetIds\":[2],\"cause\":{\"code\":7,\"message\":\"Missing or insufficient permissions.\"}}}" (vendor.js, line 137223)
[Log] [2021-06-15T14:02:34.500Z]  @firebase/firestore: – "Firestore (8.6.7): MemoryPersistence" – "Starting transaction:" – "Release target" (vendor.js, line 137223)

[karthikkondri]

Still facing this issue is 8.6.7

[craigsheppard]

Also still a problem in 8.6.8

[modernappsllc]

same problem with angularfire 6.1.5 and firebase 8.6.8 but the raw firebase by it self works fine, so there is something going on with angularfire or both

[xylo04]

Nice sleuthing @Feiyang1

[Feiyang1]

@xylo04 just wanted to make sure we actually fix this issue before closing it! 😃

So to verify, can you please try the staging release by npm install firebase@next or npm install [email protected]? I tried it with your app and it worked on my local machine.

All on this thread, if it is possible, can you please try [email protected] and let me know if it fixed your issues?

[paulstelzer]

Can confirm: [email protected] is working (I am using angular/fire) :) thank you @Feiyang1

[mazlano27]

Can confirm 8.7.0-2021528231051 is working in local environment and in deployed web app with SSR(I am also using angular/fire). Thank you @Feiyang1

[Feiyang1]

@paulstelzer, @mazlano27 Thanks for confirming! Will close the issue once the release is out.

[craigsheppard]

@Feiyang1 8.7.0-2021528231051 works here too, thanks!

[weilinzung]

We have similar issue with firebase real-time database. Can we confirm if the fix not just for forestore? @Feiyang1 thanks!