CODEWITHSUNDEEP
firebasegoogle-cloud-firestorefirebase-authenticationfirebase-security
Lucas Goldner
Lucas Goldner

Reputation: 730

How to set firebase security rules in order to allow only update of certain fields in document?

I would like to know how I can achieve that my user that has the following fields: uid, friends, notifications, name, username. Currently my security rules look like this for the user folder

function signedIn() {
  return request.auth.uid != null;
}

match /users/{user} {
  allow read, update, write: if signedIn();
}

So how can I make a rule for update: "condition", so that only friends and notifications are updateable, but not username, uid or name. Any ideas ?

Upvotes: 0

Views: 55

Answers (1)

Frank van Puffelen
Frank van Puffelen

Reputation: 599946

You're looking for map diffs.

For example:

request.resource.data.diff(resource.data).affectedKeys()
       .difference("username", "uid", "name"].toSet()).size() === 0;

Or shorter:

!request.resource.data.diff(resource.data).affectedKeys()
        .hasAny("username", "uid", "name"];

Also see:

Upvotes: 1

Related Questions