Firestore Data Validation

For prepsheets.com I use Firebase and Typescript. At the start I sort-of took type-safety to the extreme. I use runtypes to validate all the data that comes into the app and have firestore security rules which enforce a schema on the database. This is somewhat annoying, but I think it's end-positive as I can be sure of what data ends up in the database.

---

The first step is to ensure only valid field names are submitted (to stop users storing lots of arbitrary data)

function incomingData() {
   return request.resource.data;
}

function onlyHasAttrs(attrs){
   return incomingData().keys().hasOnly(attrs);
}

match /users/{userId} {
    allow create: if onlyHasAttrs(['name', 'email', 'picture', 'age']);
}

This uses the hasOnly function on lists. It checks if all keys in incomingData are in attrs

---

Next I ensure that fields are off the correct type. This is easy for strings and numbers

function hasValidSchema() {
    return (
        onlyHasAttrs(['name', 'email', 'picture', 'age']) &&
        incomingData().name is string &&
        incomingData().name.size() > 0 &&
        incomingData().age is number
    );
}

allow create: if hasValidSchema();

---

Unfortunately things are more complicated with lists and maps. While you can ensure that a field is off the type list or map you can't validate the members of those objects. Or at least you can't validate an arbitrary number of them. See: https://stackoverflow.com/a/58257828/3949864. Apparently the firebase team is looking into this so you can help get list type safety faster by filing a feature request.

For map attributes I only allow them to be set or updated to being empty. I use Cloud Functions to actually set the data, validating whatever is passed with runtypes.

function hasValidMap() {
    return (
        incomingData().map is map &&
        incomingData().map.size() == 0 ||
        incomingData().map == existingData().map
    );
}

For lists I either use Cloud Functions to set the data or impose a maximum length. For example say we let users list their interests, but they can only list 5. Then in security rules we can use:

function hasValidInterests(interests) {
    return (
        interests is list &&
        (interests.size() < 1 || interests[0] is string) &&
        (interests.size() < 2 || interests[1] is string) &&
        (interests.size() < 3 || interests[2] is string) &&
        (interests.size() < 4 || interests[3] is string) &&
        (interests.size() < 5 || interests[4] is string) &&
        (interests.size() < 6)
    );
}