Unit testing security rules with the Firebase Emulator Suite

Unit testing is like flossing; we all know we should be doing it, but not all of us actually are. And there’s no better subject to unit test than security rules, the main line of defense between your database and all of those untrustworthy clients. In this video, we'll teach you how to efficiently unit test your security rules using some helpful libraries and the latest Firebase emulator suite.

Chapters:
0:00 Introduction
1:50 Prerequisites and introducing the sample app
3:15 Introducing unit tests
5:11 Setting up the Firebase project
7:31 Creating our first unit test
8:46 Writing a unit test against Cloud Firestore
11:25 The principle of least privilege
14:04 Testing user-level security rules
18:03 Test-driven development and security rules
19:20 Refactoring
20:27 Security rules for queries
23:56 Reading a single document
24:39 The Emulator UI and adminApp
28:45 Database cleanup
30:05 Conclusion

Resources:

Watch More:

Speakers:
Todd Kerpelman, Rachel Myers

#FirebaseLive event: Firebase Live 2020; re_ty: Publish; product: Firebase - Emulator Suite; fullname: Rachel Myers, Todd Kerpelman;

[agung_laksana]

please make a new video, the syntax is no longer valid for the latest npm package

[IsaiahSmith]

I honestly don't comment on YouTube videos much, but Todd, you're videos are always extremely well done and helpful! I just had to share how much I (and I'm sure many others) enjoy the work you do helping everyone learn how to use Firebase in better ways

[thepickicool]

While we're here, I'm still wondering why there's no solution from Google for full text search in firestore. Even a separate solution would be okay. Algolia is expensive !

[scottmyers]

Excellent, the best tutorials ever. Completely generous!

[quangle]

Excellent step-by-step instructions of how to do unit test for cloud firestore with firebase emulator. Thank you very much.

[theophileavoyne]

The @firebase/testing package has been deprecated. Could you do a video tutorial explaining how to use @firebase/rules-unit-testing?

[clivehtownsend]

2:14 is pretty much how I live my life....
"Somewhat recent version of Java. I don't actually know what the precise minimum version is. I have XX installed and that seems to work"

[bartl]

It's a bit confusing that this library got renamed to @firebase/rules-unit-testing because a lot of its functionality seems useful for testing Firebase in general (such as clearing the database).

[markgoho]

The MY_PROJECT_ID needs to be exactly the same as what the emulator knows from your local project or changes to security rules will not be picked up

[felippewick]

"Let's just add an email for fun - uh, that was fun. *I need to get out more*" 😂

[mmathems]

Thank you for this one Todd, I went through this a lot today and hopefully it'll see me through what I'm currently stuck on. Nice, clear and very well explained examples. If I may also say, I am still amazed at how you managed to emulate the various circumstances in order to test them, and further amazed by how you'd be sure that the circumstances were being perfectly emulated ... It's coming from me thinking about other circumstances to emulate, and how I could be sure that I have set the circumstances perfectly. Many thanks.

[chiubaca]

I'm trying to follow along but I've getting a mocha error
Error: Timeout of 2000ms exceeded. For async tests and hooks, ensure "done()" is called; if returning a Promise, ensure it resolves.

[pebuchmann]

This video is equally helpful and fun to watch! Be careful not to miss the "await" statement when writing docs as admin to the database because if not this leads to seemingly erratic behaviour.

[viczking]

anyone know how to fix FirebaseError: Failed to get document because client is offline. I've tried running firebase emulators:start at project level and even test level. The emulator starts at port 5000 correctly and all are online as in on emulator UI. So why does it say that the client is

[Ganeki-san]

Please god update this code to use version 9 SDK, your docs link to this video but your docs literally recommend to ppl to use the version9 instead of this.

[LautaroGruss]

AWESOME. Seriously, you explain it so clear! 100!

[botable]

A lot of this does not work when using WSL

[xujok]

Just 1 year later the library has been detracted the API changed and nothing works after update ...

[GeoffreyHale]

Great tutorial! Thorough and easy to follow. So helpful. Thank you!

[dharmarajr]

I have watched this somewhere... Like yesterday XD ... But watching Todd again n again is fun n his lessons are interesting