How to set Firestore rules to restrict access?

 

Step 1: Access the Firebase Console

 

First, go to the Firebase Console. If you haven't already, sign in with your Google account. Once logged in, select the project you want to set rules for, or create a new project if you haven't done so.

 

Step 2: Navigate to Firestore Database

 

In your Firebase project dashboard, locate the left-hand navigation panel. Click on "Firestore Database" to access the Firestore settings.

 

Step 3: Go to the Rules Tab

 

After entering the Firestore Database section, you will see several tabs: "Data", "Indexes", "Rules", etc. Click on the "Rules" tab to view and edit security rules.

 

Step 4: Understanding the Firestore Security Rules Structure

 

Firestore security rules are written in a JSON-like language that lets you control database access. A basic structure looks like this:

service cloud.firestore {
  match /databases/{database}/documents {
    // Add your security rules here
  }
}

 

The match statement specifies which parts of the database the rules apply to, and inside it, you define conditions for allow read and write operations.

 

Step 5: Set Rules to Restrict Access

 

To restrict access to authenticated users only, use the request.auth variable to check if a user is authenticated.

service cloud.firestore {
  match /databases/{database}/documents {
    match /{document=\*\*} {
      allow read, write: if request.auth != null;
    }
  }
}

In this rule, access to read and write data is only allowed if the request.auth variable is not null, meaning the user is authenticated.

 

Step 6: Define Specific Rules for Collections

 

You can restrict access to specific collections by modifying the path in the match statement. For example, to restrict access to a "users" collection:

service cloud.firestore {
  match /databases/{database}/documents {
    match /users/{userId} {
      allow read, write: if request.auth != null && request.auth.uid == userId;
    }
  }
}

This rule allows read and write access only if the user is authenticated and their UID matches the userId field in the document path.

 

Step 7: Add Timestamp-Based Conditions

 

You can also use time-based conditions in your rules. For example, to restrict writing to a collection only during business hours:

service cloud.firestore {
  match /databases/{database}/documents {
    match /businessData/{document=\*\*} {
      allow write: if request.auth != null &&
                   request.time.day_of_week() >= 1 &&
                   request.time.day_of_week() <= 5 &&
                   request.time.hour() >= 9 &&
                   request.time.hour() < 17;
    }
    allow read: if request.auth != null;
  }
}

This rule restricts writes to weekdays between 9 AM and 5 PM.

 

Step 8: Test the Rules

 

Firebase provides a simulator to test your rules. Use it to ensure your rules work as expected. The simulator allows you to specify the request and see if it would be allowed or denied based on your current rules.

 

Step 9: Publish the Rules

 

Once you are satisfied with your security rules, click the "Publish" button to apply them. Now, your Firestore database will enforce these rules to control access to your data.