Beginning FlutterFire

When you created your Firestore database from the Firebase console, one of the questions that you answered during the setup was whether you wanted to use the database in test mode. This implemented a very permissive rule, so that anyone with the link to your database can get full access to your data.

But it doesn’t need to be that way: you can decide who can get access to your data through the Firestore Rules.

Get back to the Firebase console and open the Firestore database link. Here, open the Rules tab.

This is where you can setup the access rules to your Firestore collections. At the time of this recording this is version 2 of the security rules, which is specified at the first line of the rules.

rules_version = '2'; 
service cloud.firestore { 
  match /databases/{database}/documents { 

Once you specify the service where your rules apply, you use match statements to identify the documents you want to grant permissions to.

In this case match /databases/{database}/documents means you’re writing a rue that applies any Cloud Firestore database in this project. Unless you create more than a Firestore database, each project has only a single database.

All match statements point to documents, not collections: you can choose a specific document, or use wildcards to point to every document at a certain path: in this case

match /{document=**}  

Means all documents in the database. Now let’s say you want to allow authenticated users to access data: near allow read write, add

if request.auth != null; 
allow read, write: if request.auth != null;  

And click publish to save the changes. This means that only authenticated users will be able read and write to all documents in the database.

Please note that this requires using Firebase authentication. As we are using it to authenticate our users, we can use this syntax without writing any other server side or client-side code.

Of course, you could setup rules for different users or roles in your database, or different document paths. As you can see this is a powerful tool to implement permissions into your database.

Now, there’s another great tool that’s part of the Firebase family: it’s called storage. Let’s have a look at that next!