[Bug] Unable to use custom claims in firestore security rule when querying from C++ SDK

未关闭

#1,783 创建于 2025年8月15日 0 条评论 0 个 reaction 已指派 0 人在 GitHub 查看

还没有人认领这个 Issue。

评估

难度: 4/5
预计耗时: 3-5 天
新手友好度: 25/100

Issue 类型: 缺陷
描述清晰度: 基本清楚
活跃度: 停滞
技术栈: cpp, firebase
领域: authentication, databases, security

调研方向

首先，在 Mac 上使用 Firebase C++ SDK 13.0.0，以 desktop 或 iOS 为目标，使用所示的 Firestore 规则以及针对 subscriptions 的查询，复现 100% 的失败。检查 Auth 和 Firestore 请求路径，包括通过 Firebase Functions 获取的 custom claim。完成的标准是确定对于 C++ SDK 查询，该 claim 是否到达安全规则，并记录或修复 permission error 的原因。

由索引模型根据 Issue 内容生成。

描述

api: auth new type: question

[REQUIRED] Please fill in the following fields:

Pre-built SDK from the website
Firebase C++ SDK version: 13.0.0
Problematic Firebase Component: Auth and Firestore
Other Firebase Components in use: Functions, Storage
Platform you are using the C++ SDK on: Mac
Platform you are targeting: Desktop and iOS

[REQUIRED] Please describe the issue here:

I get Missing or insufficient permissions when querying firestore collection that has a security rule that looks like:

match /subscriptions/{subscriptionId} {
    allow read: if request.auth != null && request.auth.token.legacy_id == resource.data.user_id; 
}

I am using the C++ SDK, which doesn't give direct access to the auth custom claims, but I am able to fetch custom claims via a Firebase function, and see the values correctly in the client after those are fetched.

If I write a security rule that depends on those claims, it fails. Does writing a rule that uses request.auth.token.legacy_id work when the request comes from the C++ SDK?

Steps to reproduce:

What's the issue repro rate? 100%

It appears that using a custom claim (say, a numeric secondary ID) and requiring that to match a field on a document doesn't work when the query is run from the C++ SDK.

主要语言: C++
星标: 326
派生: 138
平均合并: 2 天 16 小时
30 天内合并 PR: 3