Can not access to customClaims object into firestore security rules auth.token.customProp.

[schmidt-sebastian]

Moving issue here from Firestore Node SDK: googleapis/nodejs-firestore#97

[google-oss-bot]

Hey there! I couldn't figure out what this issue is about, so I've labeled it for a human to triage. Hang tight.

[google-oss-bot]

Hmmm this issue does not seem to follow the issue template. Make sure you provide all the required information.

[bojeil-google]

I doubt this is an Admin SDK bug. Otherwise we would have noticed this a lot earlier.
I speculate the reporter of the bug is not refreshing the ID token before checking the Firebase security rules.

[hiranya911]

I agree. @mpilalex can you share your code for setting the custom claims, and your security rules?

[githubbla]

@bojeil-google, @hiranya911 He speak about access auth.token.customprop from security rules file of firestore

[christopherread]

Hello, I am also having trouble accessing my customClaims in my Cloud Firestore rules. The claims are being set, but request.auth.token doesn't have them when accessed inside my Firestore rules. The Firestore rules are difficult to debug, so I am not sure what I am doing wrong.

Firebase Function setting the claim:

functions.firestore.database().document('/some/{schoolId}/path/{email}').onWrite(async event => {
....
   const email: string = event.params.email;
   const schoolId: string = event.params.schoolId;
   const newSchoolPermissions = event.data.data();
   const user = await auth.getUserByEmail(email);
   const newClaims = { ...existingClaims, [schoolId]: newSchoolPermissions };
   await auth.setCustomUserClaims(user.uid, newClaims);
....
}

Example Firestore rule function:

function isSchoolAdmin(schoolId) {
      return isSignedIn() && 
        request.auth.token[schoolId] != null && 
        request.auth.token[schoolId].isAdmin == true;
    }

[christopherread]

Ignore me, it does work, I just had to log my user out and then in again!

[bojeil-google]

Forcing token refresh should suffice, after you the custom claims are set. In web: firebase.auth().currentUser.getIdToken(true).