Data types and global objects in Firebase security rules - Firecasts
Why Stack Overflow recommends it
Stack Overflow users link it when answering or asking how to check field types, do math, or use durations in Firestore security rules, since it is treated as the main official explanation.
Recommended by 2 people across 3 different months, 2019 to 2022.
What it is
A 13-minute Firecasts episode in which Firebase Developer Advocate Doug Stevenson walks through the data types and global objects available in Firebase security rules. It covers primitives, numeric and string operations, maps, durations and type checking.
What people said
Recommends Doug Stevenson · 2019-09 · Stack Overflow · on “Firestore Rules - Datatype Validation”
You might want to watch my video on data types in Firebase security rules [this video] . In it, I list all the different data types that you can check: value is bool value is int value is float value is number value is string value is list value is map value is timestamp value is duration value is path value is latlng
Recommends Frank van Puffelen · 2019-09 · Stack Overflow · on “How to enforce explicit data schema in document database like firestore?”
Rules around what data can be stored can be enforced in Firebase's server-side security rules [LINK] . These rules are typically used for both access control (who can access the data?) and validation of the data (what data can be stored?) For example this rule only allows documents to be written if they have lastIndex and lastUpdated fields: allow write: request.resource.data.keys().hasAll(['lastIndex', 'lastUpdated']) You could also validate the type of these fields, and even their value. For example the rules below ensure that lastIndex is a number, while lastUpdated must always be set to the same time as the server: allow write: request.resource.data.keys().hasAll(['lastIndex', 'lastUpdat
Recommends Doug Stevenson · 2019-10 · Stack Overflow · on “list type safety in firestore security rules”
If you want to check if something is an array, use `is list`. You might also want to review my video about security rules types. [this video]
Recommends Frank van Puffelen · 2020-08 · Stack Overflow · on “firestore security rule check if a field is an integer”
You can check for type with the is operator. So: request.resource.data[field] is int Or request.resource.data.field is int I highly recommend checking out Doug's video on Data types and global objects in Firebase security rules [this video] , specifically the section on checking types [this video] .
Cites Agung · 2019-12 · Stack Overflow · on “is mathematical operation valid in firebase firestore security rules?”
I have capacity as a field in my document. I want the user to decrease the capacity one by one. so I want to prevent malicious user to make capacity to be 0 directly match /events/{eventID} { allow update: if isValidUpdate() } function isValidUpdate() { return incomingData().capacity == existingData().capacity - 1 } function existingData() { // Data that exists on the Firestore document return resource.data; } function incomingData() { // Data that is sent to a Firestore document return request.resource.data; } I have tried, but I can't find mathematical operation like + - * / for security rules in the documentation or from video tutorial here [this video] is incomingData().capacity == existingDa
Cites Doug Stevenson · 2020-03 · Stack Overflow · on “How to test the type of a Cloud Firestore field, in Security Rules?”
You can use the is operator. For example: value is bool value is string value is timestamp You can see a complete list of types here: [this video]
Cites harrisonlo · 2020-05 · Stack Overflow · on “firestore database validation on type”
The only official "documentation" source I can find for type check is from this video: [this video] (at about the 11:00 mark)
Cites gustavohenke · 2022-03 · Stack Overflow · on “Firestore duration type”
It seems one can write Firestore rules that check that a value is of the duration type [LINK] , like this: allow write: if request.resource.data.bla is duration; However, it's totally cryptic how to produce such a value, at least from the web APIs. The Firestore Rules reference has a section for the duration namespace [LINK] and the Duration interface [LINK] . It is even mentioned in this official Firebase video [this video] (link points to the exact time that the duration type is being talked about). I had success testing in the Rules Playground writing a doc which had the value set to a <number>s pattern, e.g. 100s or 5s and even 0.5s , so I presumed that would map to an amount of seconds. I tr