Reads or writes to Firestore fail with 'Missing or insufficient permissions', even though the user appears to be authenticated, usually due to security rules not matching the request.
Use the Firestore Rules Playground and the Local Emulator Suite to test rules against the actual request shape before deploying.
Step-by-Step Guide
Open the Firestore Rules tab and simulate the exact failing request in the Rules Playground
Confirm request.auth != null for any rule requiring authentication
Match document ownership explicitly: resource.data.userId == request.auth.uid
Remember nested subcollections need their own match blocks - rules aren't inherited automatically
Use the Firebase Local Emulator Suite to test rules locally before deploying
Log the current user's UID client-side to confirm it matches the expected owner field
Avoid 'allow read, write: if true' in production rules
Deploy updated rules with: firebase deploy --only firestore:rules
Found an issue with this solution?
