Search code examples
google-cloud-firestorefirebase-security

Is this firebase security rule redundant?


I have a collection of users, and I have a separate collection of usernames. In my collection usernames I store different usernames as doc_ids. That is, under collection usernames I can have doc_ids as first, second, third, and so on. Under each doc_id I store the following info:

{
  ownerId: id,
  dateUpdated: someDate
}  

When I change some user's username, I execute a batch query, where I first delete the oldUsername doc, and then insert the newUsername doc with the appropriate fields. My question is regarding one of the security rules, related to the usernames collection. Do I need to check, if I already have such username (that is such doc_id). Do I need the following rule:

match /usernames/{username} {
  allow create: if !exists(/databases/$(database)/documents/usernames/$(username))
}

I think this rule, is redundant since I am enforcing the uniqueness of collection ids, but I already saw it on a few other posts, so I wanted to check other people's opinions.


Solution

  • Yup, that rule does nothing as the create will only be triggered when the document doesn't exist yet. If the document already exists, its .update will be triggered.

    This type of check is common in a .write, but not needed when you're using the more granular .create.