Allow update on single field in firestore

Question

I want to give a user the right to update a document. But ONLY if the user updates one specific field of this document. All other fields shouldn't be changed by this user.

Is this possible in firestore?

I tried something like this:

function isUpdateToOpenField(attr) {
    return attr == get(/databases/$(database)/documents/stores/$(store)).data.open;
}

allow update: if isUpdateToOpenField(request.resource.data);

But I don't know how to compare if the update corresponds to the right field.

score 40 · Accepted Answer · edited Aug 31 '21 at 05:32

40

Map diffs in the Rules language were introduced to solve this:

function isUpdateToOpenField() {
    return request.resource.data.diff(resource.data).affectedKeys().hasOnly(['open']);
}

allow update: if isUpdateToOpenField();

edited Aug 31 '21 at 05:32

Adam

3,415
4
30
49

answered Mar 09 '20 at 19:03

Scott Crossen

949
8
7

you're sending `attr` to the function but never use it – AvielNiego Jul 29 '20 at 11:48
2

now your function doesn't receive any parameters but you send it `request.resource.data` :) – AvielNiego Jul 31 '20 at 09:03
function isUpdateSpecificFieldOnly(fieldName) { return request.resource.data.diff(resource.data).affectedKeys().hasOnly([fieldName]); } – MadMac Dec 07 '22 at 23:29

Juan Lara · Answer 2 · 2020-03-10T18:39:08.323

24

Update: Instead of writeFields, you can now use Map.diff()

Check out the writeFields variable for security rules:

allow update: if ((request.writeFields.size() == 1) && ('open' in request.writeFields));

edited Mar 10 '20 at 18:39

answered Apr 05 '18 at 17:46

Juan Lara

6,454
1
22
31

how does writeFields look like with nested fields, e.g. >> update("foo.bar", baz) ? Thank you. – lenhuy2106 Jul 19 '18 at 20:36
@lenhuy2106: This `&& ('foo.bar' in request.writeFields)` works as expected. – Pascal Sep 15 '18 at 09:29

Sid Shinde · Answer 3 · 2020-09-20T14:00:22.810

You can use :

allow update: if request.resource.data.diff(resource.data).affectedKeys().hasOnly(["fieldToBeUpdated"]);

OR

allow update: if request.resource.data.diff(resource.data).affectedKeys() == ["fieldToBeUpdated"].toSet;

You can replace affectedKeys() with addedKeys() , removedKeys() or changedKeys() depending upon your use case.

affectedKeys() as the name suggests is equivalent to using all the three together.

For more details please read the docs here https://firebase.google.com/docs/reference/rules/rules.MapDiff

score 5 · Answer 4 · answered Sep 30 '19 at 06:56

Since writeFields is deprecated and should not be used, you will have to examine request.resource.data. However, it always contains all of the fields of the written document (it's final state). This means that you will have to compare all of the fields of the written document to the fields of the original document in resource.data in order to make sure that only the ones that changed are the ones that you allow to be changed.

Currently this requires an explicit check for every field that could possibly be written, which is not fun to implement. The Firebase team is looking into ways of making this sort of rule easier to express by allowing you to diff the data maps of the "before" and "after" documents.

Here is a [helpful article](https://dev.to/chinchang/restrict-specific-fields-updation-in-firebase-firestore-ohp) that discusses this strategy. Massively painful for more complex assertions. I hope this gets addressed soon. — ctrlplusb, Oct 22 '19 at 16:27

score 4 · Answer 5 · answered Nov 24 '19 at 16:28

Since request.resource.data will show the future object after the write - the only way is to check every field using the following:

   function notUpdating(field) {
     return !(field in request.resource.data)
      || resource.data[field] == request.resource.data[field]
   }

   allow update: if notUpdating('title') && notUpdating('description')

Make sure you validate that the user doesn't update all of the fields except the field you want him to have access to

score 1 · Answer 6 · answered Jul 17 '20 at 17:54

1

the same answer of "Scott Crossen" with little change, to be more genric

function isUpdateToOpenField(attr) {
    return request.resource.data.diff(resource.data).affectedKeys().hasOnly([attr]);
}

allow update: if isUpdateToOpenField('open');

answered Jul 17 '20 at 17:54

عبدالرحمن شافعى

29
3

Allow update on single field in firestore

6 Answers6

Linked