Unit testing security rules with the Firebase Emulator Suite

What people said

Recommends Frank van Puffelen · 2020-08 · Stack Overflow · on “Security of Firestore Database - SwiftUI”

As I explained on your previous question [LINK] , anyone can take the configuration data from your app, and call the Firebase APIs with that data. is this secure? Only you can determine whether your rules are correct for your use-case. These rules allow anyone to read all documents in the /Users collection. In addition they allow any authenticated user to read and write all documents. If that is the use-case you want to support, the these are the correct rules for you. So if you've enabled the anonymous authentication provider in Firebase Authentication, anyone can take you configuration data, write a minimal web page and call firebase.auth().signInAnonymously() and then read all user data w

Recommends carloswm85 · 2020-11 · Stack Overflow · on “Unit Testing with Firebase”

So far this year (2020), this problem seems to have been solved using a (beta, at the date of this comment) Firebase emulator: Build unit tests using Fb Emulators [LINK] and Unit testing security rules with the Firebase Emulator Suite, at YouTube [this video] This is done locally in the developer's computer.

Recommends Barbeuk · 2021-01 · Stack Overflow · on “Jest did not exit one second after the test run has completed. firebase rt db”

Code fix afterEach(async () => { await Promise.all(admin.apps.map(app => app?.delete())) return Promise.all(firebase.apps().map(app => app.delete())) }) After searching for 1 week on every king of support possible, I stumbled on This awesome video [LINK] . At 10:42 , I saw my answer. The famous teardown. Make sure to delete both apps coming from firebase-admin and @firebase/rules-unit-testing I went over their documentation a billion times about test setup and their official video Awesome but incomplete tutorial [this video] see 27:39 , I don't know how they and I missed that.

Recommends michaelgill1969 · 2021-01 · Stack Overflow · on “Firebase.auth().useEmulator is not a function”

Using `import * as firebase from '@firebase/testing'` and then `console.log(firebase)`, auth isn't logged. Maybe since the emulator is in beta, auth is not implemented yet. In any case, though, I think you need to set things up with `@firebase/testing`. The video [this video] has gotten me farther than the docs ... at least with Firestore. Like you, I'm stumped with Authentication.

Cites Yves Christol · 2020-08 · Stack Overflow · on “Firestore emulator and request.auth.email generating a 'Property email is undefined on object' error”

Thanks to the [this video] great resource, I installed firestore emulator and my testing environment, everything went fine except when I came to test the following rule: rules_version = '2'; service cloud.firestore { match /databases/{database}/documents { function invitationIsForMe(destEmail) { return request.auth.email == destEmail; } match /invitations/{inviteId} { allow read, delete: if invitationIsForMe(resource.destEmail); } } Which generate an error in the test: FirebaseError: Property email is undefined on object. The test is as follow: const me = {uid: 'myuserid', email: 'me@foo.bar'}; const getDb = (auth) => { return firebase.initializeTestApp({projectId: YORGA_PROJECT_ID, auth}).firest

Cites eosca · 2020-12 · Stack Overflow · on “Firebase - Web - Testing security rules - Could not reach Cloud Firestore backend”

I am trying to follow the firebase docs to test security rules ( Build unit tests [LINK] ), specifically the video [this video] . But an error does not allow me to continue... this [this video] . My emulators are ok... but anything is not working because with the emulators activated, I get the same error as before. (...the client is offline) [LINK] Anyone can help me? The testing code is the same as in the video (I have changed the project id with 'xxxxxxxxxxxxxx' to keep it private): const assert = require('assert') const firebase = require('@firebase/testing') const MY_PROJECT_ID = 'xxxxxxxxxxxxxx' describe('Our social app', () => { it('Understands basic addition', () => { assert.strictEqual(2 + 2,

Cites Ben Butterworth · 2021-01 · Stack Overflow · on “Google Firestore (NoSQL) vs PostgreSQL (SQL) For Reactjs and React Native Apps”

I had the same question, and wanted a definitive answer (I don't provide that here ), especially since some people on hacker news were preferring using generic services which don't lock you into a Cloud provider. Benefits of PostgresQL More people are familiar with PostgresQL than Firestore. It is the standard. Data scientists, infrastructure and normal developers will know how it works. Firestore is a niche offering by Google, and only people in the Firebase ecosystem will know what that is. It may be designed to be simple, but don't underestimate it: a few years ago, apps leaked all their sensitive data or allowed anyone to empty out their entire database (That was firebase ). Also, people

Cites Kato · 2021-03 · Stack Overflow · on “Uncaught Error in snapshot listener: FirebaseError: Missing or insufficient permissions for chatRooms”

The problem is that you're attempting to do a dynamic lookup in your rule based on each row of the data in this line: get(/databases/{database}/documents/boards/{boardId}/chats/{chatId}/messages/{messageId}).data.uidArray) The critical point to understand here is that rules do not look at the actual data when perform queries. Get operations are a bit different because there's exactly one record to fetch, but for queries, it only examines the query to ensure it cannot fetch data that doesn't match your rule; it never actually loads data to examine. This is covered in docs here [LINK] and there's a good video overviewing this here [LINK] . A deeper dive is here [this video] . Role based access is a

Cites Cole Van Vlack · 2021-11 · Stack Overflow · on “Unit Testing firebase_auth and firestore”

According to this Github issue [LINK] , it's not possible to run unit tests because native API calls are required. Integration tests are supposed to be possible but the page from the Github Issue [LINK] doesn't actually give an example of how to run the integration test. Alright, I think I have found what I am looking for. The firebase team does a really good job showing how to test security rules in Unit testing security rules with the Firebase Emulator Suite [this video] . What I did was I ran firebase init in my actual flutter project directory and this article Use the Firestore Emulator with Flutter [LINK] shows how to access the emulator directly in flutter, however the command to initialize

Cites flutroid · 2022-07 · Stack Overflow · on “How to unit test firestore rules with token.firebase.identities”

Just trying to test rules with google login and phone login e.g. request.auth.token.firebase.identities["google.com"] , But I can't find any document about firebase.initializeTestApp from '@firebase/rules-unit-testing' package. The offical video [this video] only mentioned about initialize with userId and email. Anyone know How to test this kind of rules?