4

In my firestore security rules, I want to have a rule, that checks if all elements of a list are of type string.

My "user" documents have a field called "friends". It is an list of strings, that represent the documentIDs of other user documents. These are my current rules:

function userIsAuthenticated() {
  return request.auth != null;
}

match /users/{userID} {

  function resourceIsValidUser() {
    return displayNameIsValid();
  }

  function displayNameIsValid() {
    return request.resource.data.displayName is string &&
      request.resource.data.displayName.size() > 0 &&
      request.resource.data.displayName.size() < 17;
  }

  function photoUrlIsValid() {
    return request.resource.data.photoUrl is string;
  }

  function friendsIsValid() {
    return request.resource.data.friends is list;
  }

  function userIsUserOwner() {
    return request.auth.uid == userID;
  }

  allow read: if userIsAuthenticated();
  allow write: if
    userIsAuthenticated() &&
    resourceIsValidUser() &&
    userIsUserOwner();

}

Is there anything I could add to the friendsIsValid() function to ensure the friends-list only contains string-values?

1 Answer 1

8

There is currently no function that checks the types of all the elements of an array. Since there is also no way to iterate an array, the only thing you can do now is predict the size of the array and check each element individually, for example array[0] is string && array[1] is string and so on.

The Firebase team is aware that some rules might need to do this. It will help escalate the matter if you file a feature request with Firebase support.

3
  • I just noticed that "array" isn't even a supported type identifier, so my code is invalid. What should I have used instead?
    – EzPizza
    Oct 6, 2019 at 13:54
  • 1
    If you want to check if something is an array, use is list. You might also want to review my video about security rules types. youtube.com/watch?v=qbd_4LT0Y4s Oct 6, 2019 at 13:55
  • Thanks, I edited the original Question and watched the video. :)
    – EzPizza
    Oct 6, 2019 at 15:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.