Cloud Firestore security rules development mode

Question

We are developing an Android app based on Cloud Firestore.

Now, we have released the app to production and we continue to add more features, the changes force us to add/change the Firestore security rules.

The question is how to test the app with new security rules but before publishing the rules to all users?

I see in docs that Firestore has some emulator, but I don't understand if he can help or it used only for unit testing, there are also an simulator to test single request in draft mode, but in the end of the day we need to test the functionality of the app manually.

In other words, is there a way to change the security rules and test the app before apply it to all users?

Also i have some question to those who using Firebase in production:

1. I guess your database splitted for development and production, do you split it in same project or create 2 projects with 2 google-services.json files, if you using in same project how do you handle changes in security rules for both versions?
2. There may be changes between the app releases and data structures, but there are only one version of rules, some rules will be not compatible with another app releases, how do you handle this situation? is there way to match specific app release to specific security rules?

Maybe i missing something important about Firestore.

Thanks in advance.

Answer 1

You may want to look into Firebase Emulators (Beta) for testing security rules:

Firebase Emulators

The Firebase Emulators make it easier to fully validate your app's behavior and verify your Firebase Security Rules configurations. Use the Firebase Emulators to run and automate unit tests in a local environment.

Sample Test:

firebase.assertFails(app.firestore().collection("private").doc("super-secret-document").get());

assertFails(pr: Promise) => Promise

This method returns a promise that is rejected if the input succeeds or that succeeds if the input is rejected. Use this to assert if a database read or write fails.

More here: https://firebase.google.com/docs/rules/unit-tests

Answer 2

I have used the Bolt, a superset that transpiles to JSON security rules. It looks like a much better option than using the standard rules and simulator through the Firebase UI especially if the rules are getting large and complex when the application grows, since Bolt allows you to create functions to re-use common code for read/write/validate logic.

Bolt Documentation:

https://github.com/FirebaseExtended/bolt/blob/master/docs/guide.md

Testing Instructions

https://github.com/FirebaseExtended/bolt/issues/80

Also Answering to our question, A Detail explanation is given here to support separate Firebase projects for your development and production environments.

Answer 3

Unfortunately i didn't find official solution, i split the security rules to development and production and the database to development and production using prefix dev-, so debug mode work with development database and matching development security rules. Off course need to add prefix to each root collection during runtime.

This way i can publish new changes to development mode without effecting production, i all work fine I am copy rules from development to production and remove `dev' prefix.

    service cloud.firestore { match /databases/{database}/documents {

            //production rules ********************************************************************
        match /data/{user}/{doc=**} {
          allow read, write: if request.auth.uid == user || hasPerrmision(request.auth.token.email);


        //development rules ********************************************************************
        match /dev-data/{user}/{doc=**} {
          allow read, write: if request.auth.uid == user || hasPerrmision(request.auth.token.email);

        }  
    } 
}