In Cloud Firestore rules - How do I check if a key is null

Question

In Cloud Firestore Rules - I have a document called task and I want to see if some data (assignee field) is null / don't exists.

I've tried:

1. resource.data.assignee == null - Does not work (Error)
2. !resource.data.hasAll(['assignee']) - Does not work (Error)

From the documentation - it states that this indeed creates an error: // Error, key doesn't exist allow read: if resource.data.nonExistentKey == 'value';

Solution 1

Reading the list comparisons of the Firestore Security rules documentation here, we can see that hasAll returns true if all values are present in the list.

// Allow read if one list has all items in the other list
allow read: if ['username', 'age'].hasAll(['username', 'age']);

The request.resource.data is a map containing the fields and values. In order to use hasAll, we must first get the keys as a list of values as shown here.

!resource.data.keys().hasAll(['assignee'])

Solution 2

Looking at the docs - https://firebase.google.com/docs/reference/rules/rules.Map

k in x  - Check if key k exists in map x

so this should work (without the keys())

!('assignee' in resource.data) 

Solution 3

if you want to make sure a key is null you need to check that this key is not part of the resource keys property:
!resource.data.keys().hasAny(['assignee'])

you can also use hasAll or hasOnly. more info here

Comments

[Andrew M.]

Should !('asignee' in resource.data.keys()) work too? Another thing to note is this, from the rules docs: "Fields not provided in the request which exist in the resource are added to request.resource.data. Rules can test whether a field is modified by comparing request.resource.data.foo to resource.data.foo knowing that every field in the resource will also be present in request.resource even if it was not submitted in the write request.", so there may be times when the key exists and you aren't expecting it to...

[dsl101]

@menehune23 That's true, and it makes it really difficult to tell if the client app has not included a field, in the case where it might already exist in the resource. In addition, the copying of resource to request fields is not honoured by the rules simulator, so you can build an update in the simulator which works, but won't work in a real app... Very frustrating.