Intermediate topics in Firebase Security Rules - Firecasts

You know the basics of Security Rules but would like to get into some more interesting topics such as querying other documents or limiting access to certain fields? You have come to the right place on this new episode of Firecasts by Todd Kerpelman and Rachel Myers!

Chapters:
0:00 Introduction and recap of unit testing security rules
1:20 Simple security and tests with Firebase Auth
4:08 Custom auth claims
8:59 Security based on user lists
14:09 Custom functions in security rules
16:40 Adding required fields in new documents
18:45 Using let to create variables in security rules
19:25 Allowing only approved fields in new documents
21:53 Allowing users to only change certain fields
23:30 Debugging security rules
25:40 The mapDiff object
28:24 Summary

Resources:

#Firecasts #Firebase #SecurityRules

[Drewmssu]

Idk why this video only has 365 likes. This is real gold

[MartinRyleOShea]

This is the most useful content I have gotten from this channel. It brought me from "how am I ever going to make this succure" to "I better watch out for the edge cases". Thanks so much for the great job!

[albertgao]

Lord, this is so good, I would careless about the DSL and just do everything in my own backend, but now I can unit test them! I can add them confidently in my clientside code, and save loads of code on the backend side, pure gold, thanks a lot!

[mysomervda]

Excellent, thanks for this one Todd. I seem to get to this point, each time I create new fire store project. It’s nice too have all this info in one video. Looks like there is a bunch of new useful capabilities in security rules to simplify the rule writing.

[smorebytes]

This is gold. Thanks so much Firebase team!

[GAschill]

This is the best video I’ve seen in this series so far. Detailed rules explanation and the new tricks of debug and mapdiff AND unit tests... 🥳 Thank you 🙏

[RobinYoulton]

This was super informative, I will be using this video as a reference again and again. I'm creating a retail app with customer messaging and sharing (Firestore at the core), so I really need to utilise these security methods - thank you Todd & Rachel!

[christophercarson]

Excellent video. One really helpful emulator feature would be to log out which rule "allowed the operation." I came to this video after beating my head against the wall trying to figure out why a create succeeded when it should have failed. I have two create rules for the path.I was was forgetting to set up the database such that the first rule failed. So my second rule (the one under test) was never getting evaluated. Your debug("this is getting called") tip helped me figure this out. But it might be nice to be able to see this in the log automatically. Thanks!

[nathanpannell]

This series of videos is super helpful and very clear. I would love a Firecast on how to unit test firebase functions. Especially functions that react to and modify firestore and realtime database. (in the emulators). Thanks for the great videos!

[cgadam]

LOL. "Goodbye to our wonderful viewers" hahaha. Thanks a lot to both of you and the Firebase team for putting together this super easy to follow and didactic videos. It means a lot to gain adoption of a complex and awesome platform like Firebase is!

[davidkim]

That was incredible! I would love to see what security roles can be placed around following users, and being notified based on another user's specific actions.

[dc]

This is awesome. Definitely learned a lot! Thank you!

[AchillRudolph]

much <3 you're the best (whenever I hit a road block, I check out these videos and end up finding solutions for my current problems!)

[maniyalraj]

Consider a social app where user_abc will be allowed to see 7 out of 10 fields for locked users unless the user_abc unlocks (by paying some credits) a particular user user_def. After unlock all the fields for user_def can be visible but only 7 fields for still other locked users.

[teze]

I really like this guy. Super awesome engineer.

[SariAlHiari]

Excellent content.

Would like more discussion on rules and patterns pertaining to queries.

Something like collection("orderItems", ref => ref.where("orderId", "==", someOid") ... and how the security rules should only allow the creator of that orderItem to read it (stored in creatorId on the document).

[vballaddict]

This is great and very helpful. I *DO* wish I could just call out "Hey Rachel" to help in real time!! ;-)

[botable]

@19:05, I would get errors if I tried to use let requiredFields. If I just directly put the list into .hasAll(["authorId"...]) it works

[myname]

Is it possible to work with the items of the set that is returned by MapDiff? Like get one of the items and check it for some value (not just with hasAll() hasAny(), really access to one item)

You could look that only one property of one item in one list has changed if you can do this.

[Lestibournes]

It would be helpful if I could use a Cloud Function that resolves to a boolean in the security rules. I have a case where I need to check for and prohibit overlaps between events on a calendar and right now that forces me to use Cloud Functions instead of continuing the serverless experience.