Hello,
I’m working on a Next.js application via FB prototyping, as I am not a hardcore developer in a managed development environment and have run into a complete blocker with both Firebase Authentication and Firestore. Any attempt to connect, either from the server-side or client-side, results in a permission error. I’m hoping someone can point me to a platform-level configuration I might be missing.
The Goal:
The primary goal is to allow users to register (Firebase Auth) and for the application to read from a premium_users collection in Firestore.
The Core Problem:
Every attempt to interact with Firebase services is met with a FirebaseError: Missing or insufficient permissions error. This happens on both the client-side (in the browser) and server-side (in Next.js server actions).
What We’ve Tried Chronologically:
-
Initial Server-Side Auth: We started with a server action to create users using the Firebase Admin SDK. This repeatedly failed with
app/invalid-credentialandCould not refresh access tokenerrors, indicating the server environment couldn’t get a valid OAuth2 token to communicate with Firebase services. -
Client-Side Auth & Firestore: We moved the logic to the client-side in the browser to bypass the server’s token issues. This also failed with
Missing or insufficient permissionswhen trying to perform user creation or database reads. -
Isolating Firestore: To debug, we created a test page (
/test-db) to perform a simple read query on thepremium_userscollection from the client. This became the focus of our debugging efforts. -
Iterating on Firestore Security Rules: We tried multiple variations of
firestore.rules, including:- Specific rules allowing
getandliston thepremium_userscollection. - Completely open rules for the entire database for debugging:
rules_version = '2'; service cloud.firestore { match /databases/{database}/documents { match /{document=**} { allow read, write: if true; } } } - Every variation resulted in the same
Missing or insufficient permissionserror.
- Specific rules allowing
-
Disabling App Check: We have confirmed via the Firebase Console that App Check enforcement for Firestore is disabled. The error still persists.
-
Query Simplification: We changed the client-side code from a filtered query (
where(...)) to fetching the entire collection to rule out any missing composite index requirements. The error remains.
Code Implementation:
Our Firebase client is initialized in src/lib/firebase.ts like this:
// src/lib/firebase.ts
import { getApp, getApps, initializeApp } from 'firebase/app';
import { getFirestore } from 'firebase/firestore';
const firebaseConfig = {
apiKey: process.env.NEXT_PUBLIC_FIREBASE_API_KEY,
authDomain: process.env.NEXT_PUBLIC_FIREBASE_AUTH_DOMAIN,
projectId: process.env.NEXT_PUBLIC_FIREBASE_PROJECT_ID,
// ... other config values
};
const app = !getApps().length ? initializeApp(firebaseConfig) : getApp();
const firestore = getFirestore(app);
export { app, firestore };
The client-side query in our test page (/test-db) is implemented as follows:
// From a test component in src/app/test-db/page.tsx
"use client";
import { firestore } from '@/lib/firebase';
import { collection, getDocs } from 'firebase/firestore';
// ... inside an async function triggered by a button click
async function testFirestoreConnection() {
try {
if (!firestore) {
throw new Error("Firestore is not initialized. Check your Firebase config.");
}
const querySnapshot = await getDocs(collection(firestore, "premium_users"));
// Processing logic would go here, but it never reaches this point.
console.log("Successfully fetched documents:", querySnapshot.size);
} catch (error) {
// This is where the "Missing or insufficient permissions" error is always caught.
console.error(error);
}
}
Current State & The Question:
We are at a point where even with completely open security rules and disabled App Check, a simple client-side getDocs() call is blocked. This strongly suggests the issue is not with the application code or the firestore.rules file, but a higher-level platform or Google Cloud configuration that is overriding these settings.
My question is: What other Firebase or Google Cloud settings could be causing a global block on all Firebase requests, resulting in a persistent “Missing or insufficient permissions” error, even when all standard security measures (Rules, App Check) are seemingly disabled or wide open?
Any pointers or suggestions for other areas to investigate would be greatly appreciated, as we are currently completely blocked from using any Firebase features.