0

I know how to check if an array contains a given string (as explained for example here). My requirement however is different: I have a document with an array updatedByHistoryArray written at server side that contains the history of the ids of all users who updated such a document, for example [id1, id2, ..., idn].

I would like to allow a delete operation for this document only if the latter has been updated exclusively by the user who wants to delete it. So, for example, if a user with id24 wants to delete a document, the updatedByHistoryArray of this document has to be [id24, id24, ..., id24].

Is it possible to implement this requirement in the security rules of Firestore?

nibbana
  • 698
  • 1
  • 8
  • 21

1 Answers1

1

It sounds possible. Try using hasOnly() to see if the list field contains only a single user ID.

resource.data.updatedByHistoryArray.hasOnly([request.auth.uid])
Doug Stevenson
  • 297,357
  • 32
  • 422
  • 441