Firestore Security Rule to allow update nested field

user_6131611 0
Viewed 191

I have a document with structure

name: "blablabla"
members:
    123: true
    456: true

Users can add themselves in members

docRef.update(FieldPath.of("members", myUid), true);

How do I write a security rule to allow this?

I tried

allow update: if is_valid(request.resource.data);
function is_valid(data) {
  return data.keys() == ['members']
      && data.members.keys() == [request.auth.uid]
      && data.members[request.auth.uid] == true;
}

But I get PERMISSION_DENIED: Missing or insufficient permissions.

(However in Security Rules Simulator access is allowed)

firebase-security google-cloud-firestore firebase
1 Answers

I came up with a condition using removedKeys. In theory, this should work as it should.

allow update: if is_valid(request.resource.data);
function is_valid(data) {
  return data.keys() == ['members']
      && data.members.keys() == [request.auth.uid]
      && afterData().members.diff(resource.data.members).removedKeys().size() == 0;
}  
function afterData() {
  return getAfter(/databases/$(database)/documents).data;
}
user_98057810
Related