What is the database rule to limit the number of children?

[Felix Halim]

Suppose I want to limit the number of children in path "/a/b" to be at most 10.

Naturally, I would try to add this security rule:

"a": {

  "b": {

    ".write": "Object.keys(newData.val()).length <= 10

  }

}

But "Object" is not accessible in the security rule.

What are the alternatives?

Felix Halim

[Alex Memering]

Depending on why you are trying to do this there might be a couple of answers.  If you're trying to always have up to a certain amount of children where new ones overwrite old ones then you probably want something like a ring buffer and Vikrum described how you might go about that.  If you're strictly interested in a security rules solution where your prevented from adding more children without disturbing the ones that already there then you'll want to take a look at this answer that Kato gave a while ago that has several solutions that differ in complexity.

Hope that helps,

--
You received this message because you are subscribed to the Google Groups "Firebase Google Group" group.
To unsubscribe from this group and stop receiving emails from it, send an email to firebase-tal...@googlegroups.com.
To post to this group, send email to fireba...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/firebase-talk/CAAbwPop3RTxFWCbX91q5jeZeR5egqt3o_FEniAAA3x1A2K1y_w%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.

--

Alex Memering |

Software Engineer |

meme...@google.com

[Felix Halim]

Hi Alex,

I'm strictly interested in security rules where users only adding new records.

I looked at Kato's answer and I feel that all those super complex, unnecessary work arounds can be eliminated if Object.keys() is present in the Firebase rules.

Kato did mention it: "since there is no .length on an object, we need to store how many records exist" -> which brings in a lot of unnecessary complexity...

Please consider adding a simple built-in method to compute the length of the children in the security rules.

On Fri, Jan 20, 2017 at 9:51 AM, Alex Memering <meme...@firebase.com> wrote:

Depending on why you are trying to do this there might be a couple of answers.  If you're trying to always have up to a certain amount of children where new ones overwrite old ones then you probably want something like a ring buffer and Vikrum described how you might go about that.  If you're strictly interested in a security rules solution where your prevented from adding more children without disturbing the ones that already there then you'll want to take a look at this answer that Kato gave a while ago that has several solutions that differ in complexity.

Hope that helps,

On Fri, Jan 20, 2017 at 7:55 AM Felix Halim <felix...@gmail.com> wrote:

Suppose I want to limit the number of children in path "/a/b" to be at most 10.

Naturally, I would try to add this security rule:

"a": {

  "b": {

    ".write": "Object.keys(newData.val()).length <= 10

  }

}

But "Object" is not accessible in the security rule.

What are the alternatives?

Felix Halim

--
You received this message because you are subscribed to the Google Groups "Firebase Google Group" group.

To unsubscribe from this group and stop receiving emails from it, send an email to firebase-talk+unsubscribe@googlegroups.com.

To post to this group, send email to fireba...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/firebase-talk/CAAbwPop3RTxFWCbX91q5jeZeR5egqt3o_FEniAAA3x1A2K1y_w%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.

--

Alex Memering |

Software Engineer |

meme...@google.com

--
You received this message because you are subscribed to the Google Groups "Firebase Google Group" group.

To unsubscribe from this group and stop receiving emails from it, send an email to firebase-talk+unsubscribe@googlegroups.com.

To post to this group, send email to fireba...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/firebase-talk/CAO0wbvhpOBD01FZJ0zBWOrjbDcpLsad23pdsbaOGc7qjc363%3Dg%40mail.gmail.com.

[Mike McDonald]

Considered and added to the Security Rules language ;)

You could imagine a world where it were ported to the existing Realtime Database:

match /a/b {

  // request.resource is a map (which it would be in RT DB, since that's just JSON)

  allow write: if request.resource.size() <= 10;

}

It's unlikely that any changes will be made to the existing JSON rules, as the format above is the direction we're moving in.

Thanks,

--Mike

On Tuesday, January 31, 2017 at 5:38:07 PM UTC-8, Felix Halim wrote:

Hi Alex,

I'm strictly interested in security rules where users only adding new records.

I looked at Kato's answer and I feel that all those super complex, unnecessary work arounds can be eliminated if Object.keys() is present in the Firebase rules.

Kato did mention it: "since there is no .length on an object, we need to store how many records exist" -> which brings in a lot of unnecessary complexity...

Please consider adding a simple built-in method to compute the length of the children in the security rules.

On Fri, Jan 20, 2017 at 9:51 AM, Alex Memering <meme...@firebase.com> wrote:

Depending on why you are trying to do this there might be a couple of answers.  If you're trying to always have up to a certain amount of children where new ones overwrite old ones then you probably want something like a ring buffer and Vikrum described how you might go about that.  If you're strictly interested in a security rules solution where your prevented from adding more children without disturbing the ones that already there then you'll want to take a look at this answer that Kato gave a while ago that has several solutions that differ in complexity.

Hope that helps,

On Fri, Jan 20, 2017 at 7:55 AM Felix Halim <felix...@gmail.com> wrote:

Suppose I want to limit the number of children in path "/a/b" to be at most 10.

Naturally, I would try to add this security rule:

"a": {

  "b": {

    ".write": "Object.keys(newData.val()).length <= 10

  }

}

But "Object" is not accessible in the security rule.

What are the alternatives?

Felix Halim

--
You received this message because you are subscribed to the Google Groups "Firebase Google Group" group.

To unsubscribe from this group and stop receiving emails from it, send an email to firebase-tal...@googlegroups.com.

To post to this group, send email to fireba...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/firebase-talk/CAAbwPop3RTxFWCbX91q5jeZeR5egqt3o_FEniAAA3x1A2K1y_w%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.

--

Alex Memering |

Software Engineer |

meme...@google.com

--
You received this message because you are subscribed to the Google Groups "Firebase Google Group" group.

To unsubscribe from this group and stop receiving emails from it, send an email to firebase-tal...@googlegroups.com.

[Adam Putinski]

Is there any timeline of when the storage rules will be ported to the database?

[andrea.c...@gmail.com]

Also interested in knowing when this might get ported over.

[Jacob Wenger]

As a matter of policy, we don't provide dates for when features will be released. It's definitely on our roadmap, but there's nothing to share at the moment.

Cheers,
Jacob

To unsubscribe from this group and stop receiving emails from it, send an email to firebase-talk+unsubscribe@googlegroups.com.

To post to this group, send email to fireba...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/firebase-talk/e2a7625f-3f66-47a0-a1df-817921316bd2%40googlegroups.com.