How to check whether only one field was updated?

bigblind

unread,

Jan 19, 2018, 10:38:02 AM1/19/18

to Firebase Google Group

If I only want users to be able to update a specific field in a document, how do I check that they didn't update anything else without exhaustively checking every field, which seems brittle?

I know I can check that they didn't add any fields by doing something like

allow update if resource.data.keys() == request.resource.data.keys()

but how do I check that only a specific value has changed?

Kato Richardson

unread,

Jan 19, 2018, 12:05:18 PM1/19/18

to Firebase Google Group

Hello “bigblind”,

Assume we’re talking about Firestore here.

I think this might be a way to do that: resource.data.size() === 1 and 'foo' in resource.data.keys()

I found that in the ref docs here.

☼, Kato

--
You received this message because you are subscribed to the Google Groups "Firebase Google Group" group.
To unsubscribe from this group and stop receiving emails from it, send an email to firebase-talk+unsubscribe@googlegroups.com.
To post to this group, send email to fireba...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/firebase-talk/51eccee3-04f5-4ae9-a611-bf1c9a9f3aff%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

--

Kato Richardson |

Developer Programs Eng |

kato...@google.com |

775-235-8398

Kato Richardson

unread,

Jan 19, 2018, 12:07:03 PM1/19/18

to Firebase Google Group

Oops, mixed up my databases. Those should be == with two and not triples.

Looks like this might be another way to write it: resource.data.size() == 1 and resource.data.keys()[0] == 'foo'

I hope that helps!

☼, Kato

Samuel Stern

unread,

Jan 19, 2018, 2:01:24 PM1/19/18

to fireba...@googlegroups.com

Kato's answer is correct if the document only contains one field and you want to keep it that way. However I assume you are asking about a multi-field document and you want to make sure that updates only affect a single field?

You're right, we don't have a good way to do this right now. We "hydrate" request.resource.data to reflect resource.data overlaid with the incoming request which means it's hard to find out where the specific difference is. We have heard this feedback before but I will make sure I add your data point, we should probably expose some getter to find out which fields have been updated.

- Sam

On Fri, Jan 19, 2018 at 9:07 AM 'Kato Richardson' via Firebase Google Group <fireba...@googlegroups.com> wrote:

Oops, mixed up my databases. Those should be == with two and not triples.

Looks like this might be another way to write it: resource.data.size() == 1 and resource.data.keys()[0] == 'foo'

I hope that helps!

☼, Kato

On Fri, Jan 19, 2018 at 10:05 AM, Kato Richardson <kato...@google.com> wrote:

Hello “bigblind”,

Assume we’re talking about Firestore here.

I think this might be a way to do that: resource.data.size() === 1 and 'foo' in resource.data.keys()

I found that in the ref docs here.

☼, Kato

On Thu, Jan 18, 2018 at 11:47 PM, bigblind <frederik...@gmail.com> wrote:

If I only want users to be able to update a specific field in a document, how do I check that they didn't update anything else without exhaustively checking every field, which seems brittle?

I know I can check that they didn't add any fields by doing something like

allow update if resource.data.keys() == request.resource.data.keys()

but how do I check that only a specific value has changed?

--
You received this message because you are subscribed to the Google Groups "Firebase Google Group" group.

To unsubscribe from this group and stop receiving emails from it, send an email to firebase-tal...@googlegroups.com.

To post to this group, send email to fireba...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/firebase-talk/51eccee3-04f5-4ae9-a611-bf1c9a9f3aff%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

--

Kato Richardson | Developer Programs Eng | kato...@google.com | 775-235-8398

--
You received this message because you are subscribed to the Google Groups "Firebase Google Group" group.

To unsubscribe from this group and stop receiving emails from it, send an email to firebase-tal...@googlegroups.com.

To post to this group, send email to fireba...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/firebase-talk/CADypTEbZAkH5rBW566zwg-NO%3D7J6hXDs5G8%2Bhwb_Wgwpo4-Nog%40mail.gmail.com.

Kato Richardson

unread,

Jan 19, 2018, 3:21:53 PM1/19/18

to Firebase Google Group

Thanks, Sam. If the goal is to write to multiple fields and only change one, I think we could do something similar to the RTDB rules approach? It’s not beautiful, but it probably functions:

// assuming foo and bar are immutable fields (and we want to allow another one, like baz to be editable)
resource.data.keys().hasAll([ ... required fields ... ]) && request.resource.data.foo == resource.data.foo && request.resource.data.bar == resource.data.bar

☼, Kato

On Fri, Jan 19, 2018 at 12:00 PM, 'Samuel Stern' via Firebase Google Group <fireba...@googlegroups.com> wrote:

Kato's answer is correct if the document only contains one field and you want to keep it that way. However I assume you are asking about a multi-field document and you want to make sure that updates only affect a single field?

You're right, we don't have a good way to do this right now. We "hydrate" request.resource.data to reflect resource.data overlaid with the incoming request which means it's hard to find out where the specific difference is. We have heard this feedback before but I will make sure I add your data point, we should probably expose some getter to find out which fields have been updated.

- Sam

On Fri, Jan 19, 2018 at 9:07 AM 'Kato Richardson' via Firebase Google Group <firebase-talk@googlegroups.com> wrote:

Oops, mixed up my databases. Those should be == with two and not triples.

Looks like this might be another way to write it: resource.data.size() == 1 and resource.data.keys()[0] == 'foo'

I hope that helps!

☼, Kato

On Fri, Jan 19, 2018 at 10:05 AM, Kato Richardson <kato...@google.com> wrote:

Hello “bigblind”,

Assume we’re talking about Firestore here.

I think this might be a way to do that: resource.data.size() === 1 and 'foo' in resource.data.keys()

I found that in the ref docs here.

☼, Kato

On Thu, Jan 18, 2018 at 11:47 PM, bigblind <frederik...@gmail.com> wrote:

If I only want users to be able to update a specific field in a document, how do I check that they didn't update anything else without exhaustively checking every field, which seems brittle?

I know I can check that they didn't add any fields by doing something like

allow update if resource.data.keys() == request.resource.data.keys()

but how do I check that only a specific value has changed?

--
You received this message because you are subscribed to the Google Groups "Firebase Google Group" group.

To unsubscribe from this group and stop receiving emails from it, send an email to firebase-talk+unsubscribe@googlegroups.com.

To post to this group, send email to fireba...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/firebase-talk/51eccee3-04f5-4ae9-a611-bf1c9a9f3aff%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

--

Kato Richardson | Developer Programs Eng | kato...@google.com | 775-235-8398

--
You received this message because you are subscribed to the Google Groups "Firebase Google Group" group.

To unsubscribe from this group and stop receiving emails from it, send an email to firebase-talk+unsubscribe@googlegroups.com.

To post to this group, send email to fireba...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/firebase-talk/CADypTEbZAkH5rBW566zwg-NO%3D7J6hXDs5G8%2Bhwb_Wgwpo4-Nog%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.

--

You received this message because you are subscribed to the Google Groups "Firebase Google Group" group.

To unsubscribe from this group and stop receiving emails from it, send an email to firebase-talk+unsubscribe@googlegroups.com.

To post to this group, send email to fireba...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/firebase-talk/CAHafJBqKYjEsmx9j0DM4%2Bdd43i1Yo7QbXWE5E5KNWWZO4gT_rw%40mail.gmail.com.

For more options, visit https://groups.google.com/d/optout.

Samuel Stern

unread,

Jan 23, 2018, 1:22:30 PM1/23/18

to Firebase Google Group

An update here: apparently I don't know everything (cue shocked gasps!).

In your security rules you can access the request.writeFields variable which should be an array of the field paths being updated in the particular request. We'll work on getting that documented ASAP.

- Sam

On Friday, January 19, 2018 at 12:21:53 PM UTC-8, Kato Richardson wrote:

Thanks, Sam. If the goal is to write to multiple fields and only change one, I think we could do something similar to the RTDB rules approach? It’s not beautiful, but it probably functions:
// assuming foo and bar are immutable fields (and we want to allow another one, like baz to be editable)
resource.data.keys().hasAll([ ... required fields ... ]) && request.resource.data.foo == resource.data.foo && request.resource.data.bar == resource.data.bar
☼, Kato

On Fri, Jan 19, 2018 at 12:00 PM, 'Samuel Stern' via Firebase Google Group <fireba...@googlegroups.com> wrote:

Kato's answer is correct if the document only contains one field and you want to keep it that way. However I assume you are asking about a multi-field document and you want to make sure that updates only affect a single field?

You're right, we don't have a good way to do this right now. We "hydrate" request.resource.data to reflect resource.data overlaid with the incoming request which means it's hard to find out where the specific difference is. We have heard this feedback before but I will make sure I add your data point, we should probably expose some getter to find out which fields have been updated.

- Sam

On Fri, Jan 19, 2018 at 9:07 AM 'Kato Richardson' via Firebase Google Group <fireba...@googlegroups.com> wrote:

Oops, mixed up my databases. Those should be == with two and not triples.

Looks like this might be another way to write it: resource.data.size() == 1 and resource.data.keys()[0] == 'foo'

I hope that helps!

☼, Kato

On Fri, Jan 19, 2018 at 10:05 AM, Kato Richardson <kato...@google.com> wrote:

Hello “bigblind”,

Assume we’re talking about Firestore here.

I think this might be a way to do that: resource.data.size() === 1 and 'foo' in resource.data.keys()

I found that in the ref docs here.

☼, Kato

On Thu, Jan 18, 2018 at 11:47 PM, bigblind <frederik...@gmail.com> wrote:

If I only want users to be able to update a specific field in a document, how do I check that they didn't update anything else without exhaustively checking every field, which seems brittle?

I know I can check that they didn't add any fields by doing something like

allow update if resource.data.keys() == request.resource.data.keys()

but how do I check that only a specific value has changed?

--
You received this message because you are subscribed to the Google Groups "Firebase Google Group" group.

To unsubscribe from this group and stop receiving emails from it, send an email to firebase-tal...@googlegroups.com.

To post to this group, send email to fireba...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/firebase-talk/51eccee3-04f5-4ae9-a611-bf1c9a9f3aff%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

--

Kato Richardson | Developer Programs Eng | kato...@google.com | 775-235-8398

--
You received this message because you are subscribed to the Google Groups "Firebase Google Group" group.

To unsubscribe from this group and stop receiving emails from it, send an email to firebase-tal...@googlegroups.com.

To post to this group, send email to fireba...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/firebase-talk/CADypTEbZAkH5rBW566zwg-NO%3D7J6hXDs5G8%2Bhwb_Wgwpo4-Nog%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.

--

You received this message because you are subscribed to the Google Groups "Firebase Google Group" group.

To unsubscribe from this group and stop receiving emails from it, send an email to firebase-tal...@googlegroups.com.

To post to this group, send email to fireba...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/firebase-talk/CAHafJBqKYjEsmx9j0DM4%2Bdd43i1Yo7QbXWE5E5KNWWZO4gT_rw%40mail.gmail.com.

For more options, visit https://groups.google.com/d/optout.

l...@nuvopoint.dk

unread,

Oct 22, 2018, 1:56:45 PM10/22/18

to Firebase Google Group

Did you remove writeFields again? It seems to have vanished from the docs.

If it has been deprecated, is there an alternative?

Top result in google is a stackoverflow answer: https://stackoverflow.com/a/50913068/536485

Lars

Reply all

Reply to author

Forward