Search code examples
google-cloud-firestorefirebase-security

Allow update on single field in firestore


I want to give a user the right to update a document. But ONLY if the user updates one specific field of this document. All other fields shouldn't be changed by this user.

Is this possible in firestore?

I tried something like this:

function isUpdateToOpenField(attr) {
    return attr == get(/databases/$(database)/documents/stores/$(store)).data.open;
}

allow update: if isUpdateToOpenField(request.resource.data);

But I don't know how to compare if the update corresponds to the right field.


Solution

  • Map diffs in the Rules language were introduced to solve this:

    function isUpdateToOpenField() {
        return request.resource.data.diff(resource.data).affectedKeys().hasOnly(['open']);
    }
    
    allow update: if isUpdateToOpenField();