How do I handle FieldValue.delete() in Firestore security rules?

Question

I have a document where each invited user has a field (their request.auth.uid), with a number value representing their access level.

I want users to be able to delete their user field from the document, but not be able to increase the level of their field.

The code to remove their own user field is simply:

documentReference.update(myUserId, FieldValue.delete());

I can delete the field fine, but I can't figure out how to write a rule to allow for this (and not other updates to the field) in Firestore Security.

I've tried rules like:

allow update: if (request.resource.data[request.auth.uid] < resource.data[request.auth.uid]);

and

allow update: if !(request.resource.data[request.auth.uid] > 0);

but they lead to errors (I'm guessing because the field no longer exists).

Something to note: the rules above will still work when I'm updating the user field value from the original value to a lower (non-delete) value, and

allow update: if request.auth.uid in request.writeFields;

still returns true when using FieldValue.delete(), so it's not an issue with the user id.

Eddie Eddie · Accepted Answer · 2018-03-28T08:45:24

One workaround for this instance is this:

allow update: if (request.resource.data.size() == resource.data.size() - 1) 
&& request.writeFields.size() == 1
&& request.auth.uid in request.writeFields
&& !(request.auth.uid in request.resource.data);

based on the comment found here: Firestore Security - allow only known fields

How do I handle FieldValue.delete() in Firestore security rules?

1 Answers