Firestore - token doesn't update in the Firestore Rules

[sanks]

• Xcode version: 9.4.1
• Firebase SDK version: 5.4.0
• Firebase Component: Firestore
• Component version: 0.12.5

The problem

After setup custom claims for a user through the Cloud Functions - the token (and custom claims together with it) weren't updated in Firestore Rules.

Even after calling getIDTokenForcingRefresh(true) the Rule doesn't allow to get a document. However, in the app, I see that the token was updated and contains my custom claim.

Only sign out and sign in again helps. But it's not good for the user...

The problem is exactly and only with Firestore Rules section. I checked the Storage Rules section with the similar rules - and the token/custom claims were updated here. Also, I checked the Cloud Functions context - the token/custom claims were updated here as well.

Steps to reproduce:

1. Setup Firestore rules based on custom claims.
2. Update user's custom claims through a Firebase Function
3. Call getIDTokenForcingRefresh(true)
4. Try to get a document that should be available only for the user with the certain custom claim.
5. Unable to get the document because of lack of permissions

Relevant Code:

Firestore Rules:

service cloud.firestore {
    match /databases/{database}/documents {
        match /items/{itemId} {
            allow read: if request.auth.token.customField == true;
        }
    }
}

Cloud Function:

const myFunction = function (data, context) {
    return FirebaseAdmin.auth().setCustomUserClaims(uid, {
	customField: true
    });
}

Function call and token refresh

functions.httpsCallable("my-function").call() { (result, error) in
    if let error = error {
        debugPrint(error)
        return
    }
    Auth.auth().currentUser?.getIDTokenResult(forcingRefresh: true, completion: { (result, error) in
        debugPrint(result?.claims["customField"]) // equals to true here, but...
        db.document("items/1").getDocument { (document, error) in
            debugPrint(document.documentID) // nil
            debugPrint(document.exists) // false
            // but the document exists in the Firestore for sure 
            // and if disable firestore rule or sign-out and sign-in again it works
        }
    })
}

[morganchen12]

@sanks instead of signing out and signing back in, are you able to work around this by reloading the user?

[sanks]

@morganchen12 no, reloading user doesn't help as well.

[mikelehen]

This is a known issue. Right now the Firestore SDK ignores token changes if the uid doesn't change. We likely need to rework the code here:

firebase-ios-sdk/Firestore/core/src/firebase/firestore/auth/firebase_credentials_provider_apple.mm

Line 61 in 49f2493

if (new_user != contents->current_user) {

Sorry for the inconvenience! For now, signing out / back-in is the only workaround.