How to fix Firebase "Missing or insufficient permissions"

"FirebaseError: Missing or insufficient permissions" (code permission-denied) means one thing: your Firestore security rules said no to that read or write. Firebase itself is working fine. The question is which rule blocked it, and why.

The 5 usual causes

1. Your rules are still locked. A new database in production mode starts with "allow read, write: if false", which blocks everything from the app.
2. Test mode expired. Test-mode rules include a date (request.time < timestamp.date(...)). When that date passes, every request is denied.
3. The user isn't signed in yet. Your code runs the query before Firebase Auth has finished loading, so request.auth is null.
4. Your query asks for more than the rules allow. Rules are not filters: if a rule only allows a user's own documents, the query must also only ask for that user's documents.
5. You're writing somewhere the rules don't cover, such as a subcollection with no match block, or a different database or project.

Step 1: find the exact request that failed

Open your browser's developer tools (F12) and look at the Console. Note the collection or document path and whether it was a read or a write. Then open Firebase Console → Firestore → Rules and use the Rules Playground to simulate that same request as a signed-in user. It tells you which line denied it.

Step 2: rules that let each user reach only their own data

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    // each user's profile: only they can read and write it
    match /users/{userId} {
      allow read, write: if request.auth != null && request.auth.uid == userId;
    }
    // documents that belong to a user (e.g. projects with an ownerId field)
    match /projects/{projectId} {
      allow read, update, delete: if request.auth != null && resource.data.ownerId == request.auth.uid;
      allow create: if request.auth != null && request.resource.data.ownerId == request.auth.uid;
    }
  }
}

Step 3: make your query match the rule

With the rules above, listing "all projects" is denied even if the user only owns some of them. Ask only for their own:

import { collection, query, where, getDocs } from "firebase/firestore";

const q = query(collection(db, "projects"), where("ownerId", "==", auth.currentUser.uid));
const snap = await getDocs(q);

Step 4: wait for sign-in before you query

import { onAuthStateChanged } from "firebase/auth";

onAuthStateChanged(auth, (user) => {
  if (user) loadMyProjects(user.uid); // only now is request.auth set
});

Don't "fix" it with allow read, write: if true. That makes your whole database public: anyone can read or delete every user's data. It's the most common way AI-built apps get breached.