how to avoid permission denied with a subcollection in firestore?

Question

I have a denied permission when i tried to read my subcollection.

This is my collection and subcollection i have Teams/membersList

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
  //Grants only a user access to its own data 
    match /users/{userId} {
      allow read, write: if request.auth.uid == userId;
    }
    //Allow requests from authenticated users
    match/Users/{document=**}{
    allow read, write: if request.auth != null;
    }
    match/Teams/{document=**}{
    allow read, write: if request.auth != null;
    match /membersList/{membersList} {
          allow read, write: if request.auth != null;
        }
  }
   match /Teams/{userId} {
      allow read, write: if request.auth.uid == userId;
    }
  match /Teams/memberLists/{document=**}{
  allow read, write: if request.auth != null;
  }
}

}

this is the part of my code with a denied permission

 let fetch = async () => {
    firestore()
      .collection("Teams")
      .where("uid", "==", await AsyncStorage.getItem("userID"))
      .get()
      .then((querySnapshot) => {
        if (querySnapshot.empty) {
          console.log("no documents found");
        } else {
          querySnapshot.forEach(async (doc) => {
            let Teams = doc._data.Activity;
            console.log(Teams);
            updateActivity((arr) => [...arr, Teams]);
            console.log(Activity);

            firestore()
              .collection("membersList")
              .get()
              .then((documentSnapshot) => {
                console.log("User exists: ", documentSnapshot.exists);

                if (documentSnapshot.exists) {
                  console.log("User data: ", documentSnapshot.data());
                }
              });
          });
        }
      });

I've still have permission denied after writing this rules. Do you have any ideas??

Answer 1

This code:

firestore()
  .collection("membersList")
  .get()

This reads from a top-level collection called membersList , which doesn't exist in your rules. So the user doesn't have access to the data, and the read gets rejected. Even if the collection doesn't exist, the read gets rejected.

If you want to read from the membersList subcollection of the current team, that's be:

doc
  .ref
  .collection("membersList")
  .get()