How to fix Permission denied. User does not have permission to access document in Firebase

Always check that the user is logged in before attempting database operations. Use onAuthStateChanged() to wait for authentication to complete:

import { getAuth, onAuthStateChanged } from "firebase/auth";
import { getFirestore, doc, getDoc } from "firebase/firestore";

const auth = getAuth();
const db = getFirestore();

onAuthStateChanged(auth, async (user) => {
  if (user) {
    // User is authenticated, safe to access Firestore
    const docRef = doc(db, "users", user.uid);
    const docSnap = await getDoc(docRef);
    console.log(docSnap.data());
  } else {
    console.log("User not authenticated");
  }
});

Never attempt Firestore operations in the root of your app or before onAuthStateChanged fires.

Go to Firebase Console > Firestore Database > Rules tab. The most common pattern is allowing users to read/write only their own documents by matching UID:

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /users/{uid} {
      allow read, write: if request.auth.uid == uid;
    }
  }
}

This rule allows users to access /users/{uid} only if they're authenticated and their UID matches the document ID.

For public collections, you might allow authenticated reads:

match /public/{document=**} {
  allow read: if request.auth != null;
  allow write: if false;
}

Never use this for production:

match /{document=**} {
  allow read, write: if true;
}

This makes your database publicly readable and writable—attackers can delete all your data.

In Firebase Console, go to Firestore > Rules and click the "Rules playground" button (or refresh after editing rules). Test if your rules allow the operation:

1. Click "Simulate read" or "Simulate write"
2. Enter the document path (e.g., users/user123)
3. Scroll down to the "Authentication" section and set the user UID:
- Click Edit next to Authentication
- Paste: { "uid": "user123" }
4. Click "Run"

The playground will tell you which rule lines allowed or denied the operation. Fix any issues before publishing.

Firestore passes the authenticated user information to your rules via request.auth. Make sure your app is signed in correctly:

import { getAuth, signInWithEmailAndPassword } from "firebase/auth";
import { getFirestore, doc, setDoc } from "firebase/firestore";

const auth = getAuth();
const db = getFirestore();

// 1. Sign in the user
await signInWithEmailAndPassword(auth, email, password);

// 2. Get the authenticated user
const user = auth.currentUser;
console.log("Signed in as:", user.uid);

// 3. Now try to write to Firestore
if (user) {
  const userRef = doc(db, "users", user.uid);
  await setDoc(userRef, {
    email: user.email,
    createdAt: new Date()
  });
}

If auth.currentUser is null or undefined, the write will be rejected because request.auth will be empty in your rules.

If your rules check for custom claims (e.g., role: "admin"), ensure the claims are set on the user's token:

// Rule that checks custom claims
match /admin/{document=**} {
  allow read: if request.auth.token.admin == true;
}

Custom claims must be set from a backend using Firebase Admin SDK, not from the client:

// Backend only (Node.js, Cloud Function, etc.)
const admin = require('firebase-admin');

const uid = 'user123';
await admin.auth().setCustomUserClaims(uid, { admin: true });

console.log('Custom claims set for user:', uid);

After setting custom claims, the user must sign out and sign back in for the claims to appear in their ID token. Client-side SDKs cannot set custom claims—attempting to do so is a security vulnerability.

If your rules have multiple conditions or roles, test each scenario in the playground:

// Example rule with multiple conditions
match /documents/{documentId} {
  allow read: if request.auth != null &&
              request.auth.token.role in ['admin', 'editor'];
  allow write: if request.auth.uid == resource.data.owner &&
               request.auth.token.role == 'admin';
}

Test each scenario:
- Unauthenticated user: Leave Authentication empty, expect Deny
- Regular user: Set { "uid": "user1", "token": { "role": "user" } }, expect Deny
- Editor user: Set { "uid": "user2", "token": { "role": "editor" } }, expect Allow for read only
- Admin user: Set { "uid": "doc_owner_id", "token": { "role": "admin" } }, expect Allow for write