truthiness in firestore security rules

Question

In the following example updatedData.maxChips is set to the number 50000 and updatedData.maxScore should not be defined.

function updatePlayerConditions(player) {
    let updatedData = request.resource.data;
    let originalData = resource.data;
    let condition1 = updatedData.maxChips > 0 ? updatedData.maxChips == originalData.maxChips : true; // worked
    let condition2 = updatedData.maxScore ? updatedData.maxScore = originalData.maxScore : true;
    return condition1 && condition2;

}

The above code for condition1 works, but when I change updatedData.maxChips > 0 to just updatedData.maxChips or !!updated.data.maxChips it doesn't work. If JS truthiness rules applied to firestore security rules than this doesn't make sense to me.

And I get the error FirebaseError: PERMISSION_DENIED: from condition2.

How can I use an undefined value in security rules? It would be especially helpful if someone could explain or point to how firebase firestore security rules work generally. I've already looked here: https://firebase.google.com/docs/rules/rules-language#building_conditions

Update: I realized I could replace updatedData.maxScore at the start of the ternary with maxScore in updatedData thanks to finding this question: Firestore Security Rules: request.time "undefined on object". I'd still be happy to find or read an explanation on how truthiness in firestore security rules works.

Doug Stevenson Doug Stevenson · Accepted Answer · 2020-07-14T01:35:12

The security rules language does not apply the same truthiness rules as JavaScript. If an express calls for a boolean, you need to provide an actual boolean expression there, or it is effectively evaluates as an error. This error will propagate up the expression evaluation until it finally rejects the rule.

(Fun fact: "error" is actually the third state of the boolean type - it's not just true/false. This is not documented anywhere, because it only complicates matters for your typical developer. It's just easier to think of any error as outright rejecting the rule without having to think about exactly how that happens.)

truthiness in firestore security rules

1 Answers