Firestore Security Rules with Testing

[@nazxuul]

This is much better than the official docs. I had no idea you could write a function in the security rules.

[@FilledStacks]

Woohooooo that’s great news for me. Not so great for Flutter docs, it’s in there. Just not a priority in the docs.

[@jonathanrhein7553]

Thanks @FilledStacks!! Awesome as always! If anybody else faces issues with the first "General Safety Rule" not passing because of the following error: "TypeError: this.cleanupTimer.unref is not a function", I was able to fix it by adding a jest-environment docblock at the top of the collections.spec.js file in order to use another test environment like so: /** * @jest-environment node */

[@FilledStacks]

Thanks Jonathan. I haven't seen that happen so thank you for sharing the solution to anyone else that might face it.

[@basdfgwe]

Such an important part of firebase, but coverage is so little and rules are so confusing.

[@FilledStacks]

yes, you can see the interest in this topic just by the views as well. Not many people care about it right now, even google.

[@martinharris4416]

@@FilledStacks But google regularly annoys me with emails that my rules are not secure , and that is very vexing/annoying

[@Akeshma]

Amazing guide so thanks

[@FilledStacks]

It’s my pleasure. thanks for watching

[@sebastianloric7074]

Thanks u so much for sharing your knowledge

[@FilledStacks]

You're very welcome Sebastian. It's my pleasure creating these videos. I try to cover topics that I struggled with that I want to share more knowledge on. Thank you for watching. I really appreciate it.

[@kemids2842]

always amazing

[@FilledStacks]

Thanks man :) Much appreciated!

[@mual77]

Thank you very much!

[@FilledStacks]

You're very welcome :) Thanks for watching

[@akashmaurya563]

I have given this video 100th like :-)

[@FilledStacks]

thank yoooouuuuuuu

[@gyenabubakar]

Can you add a link to the "first episode" in which you created the project for the viewers new to your channel?

[@FilledStacks]

Hey, this is in a firebase playlist. The first one in there is the start of this series. kzbin.info/aero/PLdTodMosi-Bzj6RIC2wGIkAxKtXPxDtca

[@colourhairskullyrics]

Oh my, Lovely. Just when i was struggling with something on this! Shall check the video in some time, dropped a like :D

[@FilledStacks]

Aweeesome! Happy to hear I'm in time to help you out. Thanks for the like.

[@TestingQuebec]

How do you handle mocking your data if you need to create a sub-collection within a document?

[@FilledStacks]

I put the path directly to the subcollection based on the other data. You can see how I do it for a normal document. Using that document Id go directly to the document using the already existing mock document.

[@diegozablah6697]

Great video! How would you go about writing a rule to allow new users to create a document in the users collection? I tried allowing create request.auth == null, but that didn't work when I also want to require certain fields for the creation?

[@FilledStacks]

Thanks, I'm happy you found it useful. You basically want any user to create a document so all you have to do is set allow true; for the specific collection path. There's nothing required to check there.

[@FilledStacks]

Field requirement you'll do in your client. Not in the firestore security rules.

[@huslukestilenethosli2226]

Great tutorial as always, i loved the way you structure the application anyway! 😀 Can you create a validation tutorial for this series, especially with the provider architecture? i think that's a good idea to put those into this series ! Thanks, and keep it up !

[@FilledStacks]

Luckily firebase provides validation for us with the errors it returns for auth as well as firestore queries. I might do a separate video on that but it's nothing special. I check before submitting if the data is valid then set a string with the error message and call notifyListeners 😅

[@CODMW2Viktor]

Really great video! Can you do a video on the way you structure your files? It would be awesome! I have read about MVVM and BLOC but I can't really understand how to implement it. I think a video about how you do would really help as you are really good at explaining. Or if you have some knowledge about where to learn more about it! Thanks and keep it up! :D

[@FilledStacks]

Thank you :) I have about 3 architecture videos out on my channel. This is the exact one that I use day-to-day. kzbin.info/www/bejne/oXWol5-Djrl5os0 . It's Mvvm based but without 2-way binding. I've found it the easiest to manage and maintain for all the apps I've built so far.

[@pratikekghare3651]

Hi, thank you for sharing your experience and knowledge. I need your help. I'm facing an error i.e "FirebaseError: "projectid" not provided in Firebase.initializeApp Will you please help me

[@FilledStacks]

Hey hey, you're very welcome. Yes, make sure the id in your project matches the one in your google-services.json file and matches your package id

[@mohammadmujahid8850]

Probably the toughest video of the series.

[@FilledStacks]

I agree. Especially since the setup also changes. But once it's done you can know for certain your firebase rules are working as expected.

[@rahulagarwal968]

How can we make sure that the application doesn't load data from firestore every time it starts ? Only fetch when some changes is done in the database.

[@FilledStacks]

Firestore keeps documents in cache for 20-30 days so it's automatic 😊 there's even an offline mode

[@rahulagarwal968]

@@FilledStacks But Everytime I press restart app ... There is loading state and then data is shown. I don't want that everytime I open app. There is request to firestore. I hope you understood my doubt ?

[@FilledStacks]

@@rahulagarwal968 I do, but it's not requesting it. put it in offline mode then put your wifi and data off. you'll see that same thing happening.

[@rahulagarwal968]

@@FilledStacks Ok and Thank you for such amazing contents ! It helped me a lot 👍

[@FilledStacks]

@@rahulagarwal968 you're very welcome. I'm happy to help 😊

[@bongbox]

Can I write a rules to expire a document after amount of time?

[@FilledStacks]

Yes. When you run test as a production code base you'll see this. allow read, write: if request.time < timestamp.date(2020, 4, 23); This says that this document can be read and written too until the 23rd of April.

[@bongbox]

FilledStacks this is a hard date but let say I just want it to last 24 hours

[@FilledStacks]

@@bongbox Oh you mean you want to dynamically write expiry dates? You can use the date from the actual document being requested and add 24 hours onto that and use the same rule as above.

[@bongbox]

Yes, expiring update. I wasn’t sure if that’s even possible. Can elaborate on that part not sure if I understood.

[@FilledStacks]

@@bongbox Add a creation date onto your document, get the document in the rule check, read the date, add 24 hours to it, check if the request is less than that date. Replace the current static date with the creation date on your document.

[@mmathems395]

Hi, I'm watching for the first time and right now I am paying attention to your getUserData() function ... At 20:57, I can see that the id field of the document is also the id of the document in the user collection ... I have been unsuccessful coding get(/database/) calls from within Firestore security rules to date (and haven't known why), so my question is, is the copying of the document's id (as shown) the only way to achieve get(/database/) calls successfully please? Many thanks for sharing your example.

[@FilledStacks]

Hi, I don't understand your question, I think you might be confusing 2 different things together. What are you trying to achieve, it'll be easier to point you in the right direction if I know where you want to go.

[@mmathems395]

@@FilledStacks Thank you for your response. I will draft a question and then get back to you.

[@FilledStacks]

@@mmathems395 I’ll look out for it

[@mmathems395]

@@FilledStacks The magnitude of interest in the subject tells me that this is a trickier issue than most. I suspect that there's something wrong.

[@FilledStacks]

@M Mathems i see. Well I hope you find a solution.