To review release notes for the Firebase console and for other Firebase
platforms and related SDKs, refer to the
Firebase Release Notes.
-
Cross-service Rules (Security Rules Language
enhancement). We're excited to deliver one of the most popular feature requests
for Security Rules. Security Rules in Cloud Storage for Firebase now supports
cross-service Rules with two brand new functions, firestore.get()
and firestore.exists(). These functions let you query your
project's Firestore data, similar to the get() and
exists() functions in Firestore Rules.
How can you use it?
Say you have a social media app, and you want to allow users to share
photos with a set of friends. Your Firestore database stores data related
to your users in a collection called users, with a document for
each user’s UID.
Within each document (representing a user), there’s a list
called friends that contains other UIDs. The photos for the
main application are stored in Cloud Storage for Firebase, with each user
having a folder named for their UID.
To only allow each user to view the pictures of their friends, you can add
rules like:
service firebase.storage {
match /b/{bucket}/o {
match /users/{uid}/files/{fileId} {
// Owners can view and update their own files if they're listed in Firestore
allow write, read: if
request.auth.uid == uid &&
firestore.exists(/databases/(default)/documents/users/$(uid));
// Friends can read if they are listed
allow read: if
request.auth.uid in
firestore.get(/databases/(default)/documents/users/$(uid)).data.friends;
}
}
}
Requests Monitor Security Rules lets you inspect
requests made to your local Firestore Emulator in real-time, including the
request method, path, and how Security Rules were evaluated. Check out
this blog post
for more detail. It's available in the Emulator Suite that shipped in the
Firebase CLI v9.16.0.
