This is very counter intuitive but is the javascript library somehow not fully compatible with Firestore security rules?
I would assume there is no connection between security rules syntax and client side requests.
However, Im getting this behavior in a snippet of Firestore security rules:
// Works fine in tests with test suite
// Does NOT work with javascript library
request.auth.token.roles[userRole].hasAny([ "admin", "owner" ])
// Works fine in tests with test suite
// Also works fine with javascript library
request.auth.token.roles[userRole] in ([ "admin", "owner" ])
Edit: The error on the emulator is very descriptive:
function not found error: name: [hasany]
So basically it seems that the javascript library isn't compatible with the security rules?
Im using the latest version of everything:
hasAny is a construct of the Firestore security rules and does not exist in regular JavaScript arrays.
Your in solution in JavaScript is interesting, as I probably would've used some() for this.
Obviously it was my fault.
This:
request.auth.token.roles[userRole]
Returns a String. hasAny is a function of the List interface. It was passing all the tests because in the mocks the value was being mapped as an array. When calling from the client the rules logically failed.