Skip to main content

A month of Flutter: Firestore create user rules and tests


Originally published on bendyworks.com.

When a user signs in with Google I'm going to create a user document in Firestore. Each authenticated user should only be able to create one user document. These documents will eventually be readable by other users so Firestore needs to have server(less)-side validation to keep the data as correct as possible.
Right now I'm working on registering users so I'm only going to implement create rules, not readupdate, etc.
match /users/{userId} {
  allow create: if isOwner(userId) &&
                  // TODO: enable after bug fix https://github.com/firebase/firebase-tools/issues/1073
                  //  validCreateTimestamps() &&
                  validCreateUser();
}
This will allow user documents to be created if the owner has the same ID and the document being created passes validation.
Validation of timestamps is being skipped because of a bug in the emulator that causes tests to hang. I've also been considering moving createdAt and updatedAt timestamps into Cloud Functions but I'm not ready to make that commitment yet.
User document creation is primarily validated with two tests. One to make sure an authenticated user can create their own document and one to make sure a user can't create a document for someone else.
@test
async 'can create self'() {
  const uid = this.user().uid;
  const user = this.db({ uid }).collection('users').doc(uid);
  await firebase.assertSucceeds(user.set(this.validUser));
}

@test
async 'can not create someone else'() {
  const user = this.db(this.user()).collection('users').doc(uuid.v4());
  await firebase.assertFails(user.set(this.validUser));
}
Additionally, there are several tests that iterate over a number of invalid values and assert they fail.
There are a number of helper methods I've defined in firestore.rules:
function isOwner(userId) {
  return request.auth != null &&
          request.auth.uid == userId;
}
The isOwner helper checks to see if the user document ID matches that of the current authenticated user.
function validString(key) {
  return data()[key].trim() == data()[key] &&
          data()[key].size() > 0;
}
The validString helper checks to see that a required string has a value.
function validUrl(url) {
  return url.matches('https://[a-zA-Z].+');
}
The validUrl helper checks that a string starts with https://. I'm pretty sure this will not correctly validate some URLs but this value should generally be set to a Google CDN so I don't think invalid hosts will come up.
function validCreateTimestamps() {
  return data().updatedAt == request.time &&
          data().createdAt == request.time;
}
validCreateTimestamps checks that the updatedAt and createdAtvalues match the time on the request. This works because the client will set that value with a constant that Firestore will replace with the current time.
function validUser() {
  // TODO: prevent extra fields
  return validString('nickname') &&
          validString('fullName') &&
          validString('photoUrl') &&
          validUrl(data().photoUrl);
}

function validCreateUser() {
  return validUser() &&
          data().agreedToTermsAt == request.time;
}
The final two helpers are to validate a user document leveraging all the other helpers. One TODO I've left for the future is to make sure all fields on the document are on an allowed list.
I'm not completely happy with how the server tests are currently organized. I will probably do some cleanup in the future to try and make everything more elegant. I plan on adding faker.js for fun too.

Code changes

Comments

Popular posts from this blog

Sync is currently experiencing problems

Update : I now recommend you install Google Chrome  and  disable  the built in Browser as it supports encrypting all synced data. After picking up a gorgeous  Galaxy Nexus yesterday I was running into an issue where my browser data wasn't syncing to the phone. After a little Googling I found this is commonly caused by having all of my synced Chrome data encrypted instead of the default of only encrypting the passwords. These are the steps I went through to get my dat syncing again without losing any of it. The exact error I was getting was "Sync is currently experiencing problems. It will be back shortly." In Google Chrome open the personal stuff settings page by clicking this link or by opening the wrench menu, and click on "signed in with example@gmail.com".  Hit "disconnect your Google Account" to temporarily disable syncing from your browser. Visit the Google Dashboard and "Stop sync and delete data from Google". I waite

A month of Flutter: a look back

Originally published on bendyworks.com . This is it. 31 blog posts in 31 days. Writing  a month of flutter  has been a ton of work but also lots of fun and a good learning experience. I really appreciate how supportive and and positive everyone as been. Publishing experience For the series I've been posting on  bendyworks.com ,  DEV ,  my personal blog , and  Medium . After publishing to these sites, I would put the Bendyworks link on  Twitter ,  Reddit , and the  Flutter Study Group Slack . Posting to DEV was easy as they use Markdown just like the Bendworks blog. DEV also has built in support for a  series of posts  so it's easy to read the entire series. I did have to manually upload any embedded images. DEV also has a number of  liquid tags  for embedding things like GitHub issues that I didn't make as much use of as I should have. Blogger is rich text so it was easy to copy/paste the rendered posts. This would hotlink all the images though so I had to rem

A month of Flutter: the real hero animation

Originally published on bendyworks.com . For the last post before the month's wrap up tomorrow, I wanted to do something more fun: use a  hero animation between the home page list and the individual post page. When I first implemented the  Hero  animation it never worked going back from a  PostPage  to the  HomePage . The reason was that  HomePage  would get rerendered and that would  generate new fake posts . So I moved the fake data generation up a level to  MyApp  and pass it into  HomePage . This is more realistic as going to the  HomePage  shouldn't request the  Post s every time. HomePage ( title: 'Birb' , posts: _loadPosts ( context ), ) The  PostPage  implementation is a simple  StatelessWidget  that takes  Post  and renders a  PostItem . This will become more complex as things like comments and likes are implemented but works for now. class PostPage extends StatelessWidget { const PostPage ({ Key key , @required this