Cloud Firestore Security Rules for array operations

user_8170714 0
Viewed 1821

I'm trying to restrict certain operations towards Firestore to creating or appending to an array. How should I do that? How can I distinguish arrayUnion() from arrayDelete()? What about distinguishing array operations from all the other operations?

Update: So far, from what I got by digging into the Firestore API, I'm guessing maybe something like allow create, FieldValue.arrayUnion: if true could work, but I haven't tested it yet, will update when I tested it.

firebase-security google-cloud-firestore firebase
1 Answers

If you want to ensure that any updates to the document don't remove any f the existing values from the array, you're looking for hasAll:

allow update: if request.resource.data.arrayField.hasAll(resource.data.arrayField);

I just quickly tested this in the simulator. Updating a document that has arrayField: ["value1", "value2"], I:

  • Failed when writing arrayField: ["value1"]
  • Succeeded when writing arrayField: ["value1", "value2"]
  • Succeeded when writing arrayField: ["value1", "value2", "value3"]
user_2091030
Related