Firestore Permissions

SaaSStinger Lite uses Firestore Security Rules to protect application data.

Permission checks are based on:

• Authentication state
• Workspace membership
• User roles
• Resource ownership

A permission error usually means one of these checks failed.

Understanding Permission Flow

Firestore access follows this pattern:

User Authentication

        ↓

Workspace Membership

        ↓

Role Verification

        ↓

Resource Access

Common Permission Error

Example:

FirebaseError: PERMISSION_DENIED

This means Firestore rejected the request.

The application code may be correct, but the security rules blocked the operation.

Missing Authentication

Symptoms

Example:

Permission denied while creating document

Cause

The request was made without an authenticated Firebase user.

Check:

auth.currentUser

Expected:

Authenticated User Object

Solution

Ensure:

• User is logged in
• Firebase authentication state has loaded
• Protected operations run after authentication is ready

Missing Membership Document

Symptoms

A user can log in but cannot access workspace data.

Cause

The user does not have a matching membership document.

Expected structure:

memberships/{userId}_{workspaceId}

Example:

memberships/

9os0QHS7zPc45VZx1vpp14kCIrC2_workspaceId

Solution

Verify:

userId

+

workspaceId

+

membership role

exist.

Incorrect Workspace ID

Symptoms

A valid user receives:

PERMISSION_DENIED

Cause

The request references a workspace the user does not belong to.

Example:

workspaceId = "incorrect-id"

Debug Steps

Check:

1. Active workspace ID
2. Membership document
3. Request payload
4. Firestore document path

Role Permission Failures

Symptoms

User can view data but cannot perform actions.

Example:

Member cannot delete project

Cause

The operation requires a higher role.

Current roles:

OWNER

ADMIN

MEMBER

Example:

Delete Workspace

Required:

OWNER

OWNER Permissions

OWNER can:

• Manage workspace
• Manage members
• Change roles
• View audit logs
• Perform administrative actions

ADMIN Permissions

ADMIN can:

• Manage workspace members
• Perform administrative tasks
• View audit logs

MEMBER Permissions

MEMBER has limited workspace access.

MEMBER cannot:

• Change roles
• Delete workspace
• Access administrative actions

Firestore Rules Evaluation Errors

Symptoms

Example:

evaluation error at line XX

Common Causes

Null Values

Example:

Cannot read property from null

Cause:

A document or field does not exist.

Missing Fields

Example:

resource.data.workspaceId

does not exist.

Incorrect Document Path

Example:

Expected:

memberships/{membershipId}

Received:

memberships/{wrongId}

Debugging Checklist

When a permission error occurs:

1. Check Authentication

Confirm:

User UID exists

2. Check Workspace

Confirm:

workspaceId exists

3. Check Membership

Verify:

memberships/{userId}_{workspaceId}

contains:

{
  userId,
  workspaceId,
  role
}

4. Check Rules

Review:

firestore.rules

Confirm:

• Helper functions
• Role checks
• Collection paths

Client vs Server Access

SaaSStinger Lite uses both:

Client Firebase SDK

Used for:

• Authentication state
• Client interactions

Server Actions

Used for:

• Protected writes
• Business operations
• Administrative actions

Recommended Pattern

Avoid:

Component

 ↓

Direct Firestore Write

Prefer:

Component

 ↓

Server Action

 ↓

Service

 ↓

Repository

 ↓

Firestore

Invite Permission Issues

Common invitation errors:

Invitation Failed

or:

This invitation belongs to another email address

Check

Verify:

• Invite email matches user email
• Invite token is valid
• Invite workspace exists
• User has permission to create invites

Testing Rules Locally

Use Firebase Emulator:

firebase emulators:start

Test:

• Authenticated access
• Workspace isolation
• Role permissions

Production Checklist

Before deployment:

Verify:

• Firestore rules deployed
• Indexes deployed
• Authentication enabled
• Admin variables configured

Security Notes

Never fix permission errors by:

• Opening Firestore rules
• Allowing unrestricted reads/writes
• Removing authentication checks

The correct fix is identifying why authorization failed.

Contact Support

Include:

• Error message
• Firestore collection path
• User role
• Workspace ID (not sensitive credentials)
• Steps to reproduce

Never include:

• Firebase private keys
• Service account files
• Passwords

Related Documentation

• Firestore Schema
• RBAC Permissions
• Authentication Errors
• Firebase Setup
• Common Issues