How to limit in Cloud Firestore security rules

0
votes

I'm making a charity app that uses the Firebase SDK to directly talk to Cloud Firestore from within the application

Anyone (user or not) can create a charity, every charity is located in a city.

If the user adds a new one, I want to stop the other users from creating a new charity for 30 minutes in the city he created the charity in.

And I think this is the way to implement the 30 minute duration but how can I make it in each city

match /charity/{document=**} {
  allow create: if isCalm(); 
  request.time > resource.data.timestamp + duration.value(30, 'm');
 }
}

If you didn't understand here's an example : let's say i have 3 cities (A B and C) , if the user create a charity in city A i want to stop anyone from creating charities in city A for 30 minutes ..

2
firebasefluttergoogle-cloud-firestorefirebase-security
Please post your database structure screenshot so that we can test code as per that. Also post the code by which you are currently posting new charity created details in the database. – Dharmaraj
thanks for your comment i think the one who answered is right maybe i can't handle it with rules – oth man
You have to use cloud functions. I can help with that if you agree to use cloud functions.. – Dharmaraj
well that's a great idea , i don't know about cloud functions so will try to read and learn about that , thank you so much – oth man
Alright let me know when you are ready. If you watch Firecasts on Youtube [official videos from firebase] you'll learn quickly. They are best – Dharmaraj

2 Answers

1
votes

I'm not sure you can handle this with rules... And if you can when an user will try to create a new charity it will trown an exception witch is not a good practice... You're better to add a TimeStamp to your Firestore document, get the document and verify if 30 minutes have past

1
votes

I have not tried this myself.

If you have 1 collection, called Cities, and in that, a subcollection called charities. Then, when you access your specific charity subcollection to go and write a new charity document, a security rule can ensure that parent (city) field meets your condition of at least 30 minutes. You would have to create a new field, lastModified or lastCharityCreatedAt in the city document. This way, you don't need cloud functions.

In summary: keep track of the last write, in a parent document so you can check it when you need to.