Firestore安全性 - 仅允许已知字段

Question

我无法弄清楚如何在Firestore中正确设置'.validate'规则.基本上,我想允许用户文档只包含我知道的字段:

user {
 name: "John"
 phone: "2342222"
 address: "5th Avenue"
}

我不想要除上面3之外的任何其他领域(姓名,电话,地址).

这些字段不会同时保存.姓名和电话将被保存,只有当用户想要编辑他的个人资料时才会保存地址.

我已经尝试过以下规则,但似乎不起作用:

allow read: if request.auth.uid == uid;
allow write: if request.auth.uid == uid && 
 request.resource.data.keys() in ["name", "phone", "address"]

感谢帮助.

Answer 1

您可以分开你的规则,包括不同的create和update(以及delete)的逻辑:

// allows for creation with name and phone fields
allow create: if request.resource.data.size() == 2
              && request.resource.data.hasAll(['name', 'phone'])
              && request.resource.data.name is string
              && request.resource.data.phone is string;
// allows a single update adding the address field
// OR (||) in additional constraints
allow update: if request.resource.data.size() == resource.data.size() + 1
              && !('address' in resource.data)
              && request.resource.data.address is string;

Answer 2

您正在寻找size()和hasOnly()方法。

allow write: if request.resource.data.size() == 3 
             && request.resource.data.keys().hasOnly(['name', 'phone', 'address'])

使用size()可以确保字段的准确数量。结合使用它hasOnly()可以将其锁定到那些特定字段。

您可以在Cloud Firestore规则参考文档中阅读更多内容。

Answer 3

要添加 Mike McDonald 的回答，要检查特定键，现在的表单是：

request.resource.data.keys().hasAll

代替

request.resource.data.hasAll

完整示例：

// allows for creation with name and phone fields
allow create: if request.resource.data.size() == 2
              && request.resource.data.keys().hasAll(['name', 'phone'])
              && request.resource.data.name is string
              && request.resource.data.phone is string;
// allows a single update adding the address field
// OR (||) in additional constraints
allow update: if request.resource.data.size() == resource.data.size() + 1
              && !('address' in resource.data)
              && request.resource.data.address is string;

更多信息请访问：https : //firebase.google.com/docs/reference/rules/rules.Map