Add new property to news documents on Firebase
I'm creating a voting system. For this the client cannot send votes: 0 because he could modify this to any number.
How can I add votes: 0 for new documents or detect that this property is not 0 and cancel it (prefer the first approach) from Firestore?
firebase google-cloud-firestore
asked Nov 13 '18 at 10:45
Daniel RodriguezDaniel Rodriguez
437417
add a comment |
I'm creating a voting system. For this the client cannot send votes: 0 because he could modify this to any number.
How can I add votes: 0 for new documents or detect that this property is not 0 and cancel it (prefer the first approach) from Firestore?
firebase google-cloud-firestore
asked Nov 13 '18 at 10:45
Daniel RodriguezDaniel Rodriguez
437417
add a comment |
I'm creating a voting system. For this the client cannot send votes: 0 because he could modify this to any number.
How can I add votes: 0 for new documents or detect that this property is not 0 and cancel it (prefer the first approach) from Firestore?
firebase google-cloud-firestore
asked Nov 13 '18 at 10:45
Daniel RodriguezDaniel Rodriguez
437417
I'm creating a voting system. For this the client cannot send votes: 0 because he could modify this to any number.
How can I add votes: 0 for new documents or detect that this property is not 0 and cancel it (prefer the first approach) from Firestore?
firebase google-cloud-firestore
firebase google-cloud-firestore
asked Nov 13 '18 at 10:45
Daniel RodriguezDaniel Rodriguez
437417
asked Nov 13 '18 at 10:45
Daniel RodriguezDaniel Rodriguez
437417
asked Nov 13 '18 at 10:45
Daniel RodriguezDaniel Rodriguez
437417
asked Nov 13 '18 at 10:45
Daniel RodriguezDaniel Rodriguez
437417
asked Nov 13 '18 at 10:45
Daniel RodriguezDaniel Rodriguez
437417
437417
add a comment |
add a comment |
2 Answers
2
active
oldest
votes
You would use security rules different document methods such as using a certain rule for create and another for update.
service cloud.firestore {
match /databases/{database}/documents {
match /votes/{voteId} {
allow create: if request.resource.data.votes == 0
allow update: if request.resource.data.votes == resource.data.votes
}
}
}
This would mean a user could create a vote but they have to set votes to 0 and you can update a vote document but votes would need to equal the current value. You would also want to look at other rules such as
request.resource.data.size() == 1 to limit the fields in the document being added
request.resource.data.keys().hasAll(['field_1','field_2']) to ensure it has all the fields necessary to update/create the document.
answered Nov 13 '18 at 13:13
Jack WoodwardJack Woodward
61139
Good info. With this I'd have cover the security part but what about when the user needs to vote up some document? It'd need to be +1 or -1 and we're saying here that the votes need to be equal to the ones we have already, right?
– Daniel Rodriguez
Nov 13 '18 at 17:24
1
You have a few option, using Frank's suggestion you would do a transaction and amend the security rule to sayrequest.resource.data.votes == resource.data.votes + 1or you can use another collection to store the vote and then using a cloud function have it update the main document in a trusted environment but still using transactions to ensure consistency
– Jack Woodward
Nov 13 '18 at 17:30
with a "cloud function" you mean a function that you have in rules? I have some functions for example to detect if the uses is logged or not but not sure if those cloud functions are something different (sorry, don't really have too much experience with Firebase)
– Daniel Rodriguez
Nov 15 '18 at 22:33
add a comment |
This should be a fairly basic combination of reading data from the collection and then performing transactions of batched updates. If you're having trouble implementing this, show the minimal code that reproduces where you got stuck.
Definitely also implement Jack's security rules, as those will prevent having to do this again in the future.
answered Nov 13 '18 at 14:53
Frank van PuffelenFrank van Puffelen
229k28374398
hmmm, not sure if I follow you... this should be written on the client side, right? Maybe you're pointing a normal get and post to the ddbb? If so, that's fine, I'm getting at the moment some date and also updating the user but now I have this new property which requires some extra security rules
– Daniel Rodriguez
Nov 13 '18 at 17:29
1
The code to backfill the existing documents can be run on a client, or on a server/Cloud Functions using an Admin SDK. It doesn't really matter where it runs, since you're likely to only run it once, if you follow the advice from Jack.
– Frank van Puffelen
Nov 13 '18 at 17:32
add a comment |
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53279265%2fadd-new-property-to-news-documents-on-firebase%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
2 Answers
2
active
oldest
votes
2 Answers
2
active
oldest
votes
active
oldest
votes
active
oldest
votes
You would use security rules different document methods such as using a certain rule for create and another for update.
service cloud.firestore {
match /databases/{database}/documents {
match /votes/{voteId} {
allow create: if request.resource.data.votes == 0
allow update: if request.resource.data.votes == resource.data.votes
}
}
}
This would mean a user could create a vote but they have to set votes to 0 and you can update a vote document but votes would need to equal the current value. You would also want to look at other rules such as
request.resource.data.size() == 1 to limit the fields in the document being added
request.resource.data.keys().hasAll(['field_1','field_2']) to ensure it has all the fields necessary to update/create the document.
answered Nov 13 '18 at 13:13
Jack WoodwardJack Woodward
61139
Good info. With this I'd have cover the security part but what about when the user needs to vote up some document? It'd need to be +1 or -1 and we're saying here that the votes need to be equal to the ones we have already, right?
– Daniel Rodriguez
Nov 13 '18 at 17:24
1
You have a few option, using Frank's suggestion you would do a transaction and amend the security rule to sayrequest.resource.data.votes == resource.data.votes + 1or you can use another collection to store the vote and then using a cloud function have it update the main document in a trusted environment but still using transactions to ensure consistency
– Jack Woodward
Nov 13 '18 at 17:30
with a "cloud function" you mean a function that you have in rules? I have some functions for example to detect if the uses is logged or not but not sure if those cloud functions are something different (sorry, don't really have too much experience with Firebase)
– Daniel Rodriguez
Nov 15 '18 at 22:33
add a comment |
You would use security rules different document methods such as using a certain rule for create and another for update.
service cloud.firestore {
match /databases/{database}/documents {
match /votes/{voteId} {
allow create: if request.resource.data.votes == 0
allow update: if request.resource.data.votes == resource.data.votes
}
}
}
This would mean a user could create a vote but they have to set votes to 0 and you can update a vote document but votes would need to equal the current value. You would also want to look at other rules such as
request.resource.data.size() == 1 to limit the fields in the document being added
request.resource.data.keys().hasAll(['field_1','field_2']) to ensure it has all the fields necessary to update/create the document.
answered Nov 13 '18 at 13:13
Jack WoodwardJack Woodward
61139
Good info. With this I'd have cover the security part but what about when the user needs to vote up some document? It'd need to be +1 or -1 and we're saying here that the votes need to be equal to the ones we have already, right?
– Daniel Rodriguez
Nov 13 '18 at 17:24
1
You have a few option, using Frank's suggestion you would do a transaction and amend the security rule to sayrequest.resource.data.votes == resource.data.votes + 1or you can use another collection to store the vote and then using a cloud function have it update the main document in a trusted environment but still using transactions to ensure consistency
– Jack Woodward
Nov 13 '18 at 17:30
with a "cloud function" you mean a function that you have in rules? I have some functions for example to detect if the uses is logged or not but not sure if those cloud functions are something different (sorry, don't really have too much experience with Firebase)
– Daniel Rodriguez
Nov 15 '18 at 22:33
add a comment |
You would use security rules different document methods such as using a certain rule for create and another for update.
service cloud.firestore {
match /databases/{database}/documents {
match /votes/{voteId} {
allow create: if request.resource.data.votes == 0
allow update: if request.resource.data.votes == resource.data.votes
}
}
}
This would mean a user could create a vote but they have to set votes to 0 and you can update a vote document but votes would need to equal the current value. You would also want to look at other rules such as
request.resource.data.size() == 1 to limit the fields in the document being added
request.resource.data.keys().hasAll(['field_1','field_2']) to ensure it has all the fields necessary to update/create the document.
answered Nov 13 '18 at 13:13
Jack WoodwardJack Woodward
61139
You would use security rules different document methods such as using a certain rule for create and another for update.
service cloud.firestore {
match /databases/{database}/documents {
match /votes/{voteId} {
allow create: if request.resource.data.votes == 0
allow update: if request.resource.data.votes == resource.data.votes
}
}
}
This would mean a user could create a vote but they have to set votes to 0 and you can update a vote document but votes would need to equal the current value. You would also want to look at other rules such as
request.resource.data.size() == 1 to limit the fields in the document being added
request.resource.data.keys().hasAll(['field_1','field_2']) to ensure it has all the fields necessary to update/create the document.
answered Nov 13 '18 at 13:13
Jack WoodwardJack Woodward
61139
answered Nov 13 '18 at 13:13
Jack WoodwardJack Woodward
61139
answered Nov 13 '18 at 13:13
Jack WoodwardJack Woodward
61139
answered Nov 13 '18 at 13:13
Jack WoodwardJack Woodward
61139
61139
Good info. With this I'd have cover the security part but what about when the user needs to vote up some document? It'd need to be +1 or -1 and we're saying here that the votes need to be equal to the ones we have already, right?
– Daniel Rodriguez
Nov 13 '18 at 17:24
1
You have a few option, using Frank's suggestion you would do a transaction and amend the security rule to sayrequest.resource.data.votes == resource.data.votes + 1or you can use another collection to store the vote and then using a cloud function have it update the main document in a trusted environment but still using transactions to ensure consistency
– Jack Woodward
Nov 13 '18 at 17:30
with a "cloud function" you mean a function that you have in rules? I have some functions for example to detect if the uses is logged or not but not sure if those cloud functions are something different (sorry, don't really have too much experience with Firebase)
– Daniel Rodriguez
Nov 15 '18 at 22:33
add a comment |
Good info. With this I'd have cover the security part but what about when the user needs to vote up some document? It'd need to be +1 or -1 and we're saying here that the votes need to be equal to the ones we have already, right?
– Daniel Rodriguez
Nov 13 '18 at 17:24
1
You have a few option, using Frank's suggestion you would do a transaction and amend the security rule to sayrequest.resource.data.votes == resource.data.votes + 1or you can use another collection to store the vote and then using a cloud function have it update the main document in a trusted environment but still using transactions to ensure consistency
– Jack Woodward
Nov 13 '18 at 17:30
with a "cloud function" you mean a function that you have in rules? I have some functions for example to detect if the uses is logged or not but not sure if those cloud functions are something different (sorry, don't really have too much experience with Firebase)
– Daniel Rodriguez
Nov 15 '18 at 22:33
Good info. With this I'd have cover the security part but what about when the user needs to vote up some document? It'd need to be +1 or -1 and we're saying here that the votes need to be equal to the ones we have already, right?
– Daniel Rodriguez
Nov 13 '18 at 17:24
Good info. With this I'd have cover the security part but what about when the user needs to vote up some document? It'd need to be +1 or -1 and we're saying here that the votes need to be equal to the ones we have already, right?
– Daniel Rodriguez
Nov 13 '18 at 17:24
1
1
You have a few option, using Frank's suggestion you would do a transaction and amend the security rule to say
request.resource.data.votes == resource.data.votes + 1 or you can use another collection to store the vote and then using a cloud function have it update the main document in a trusted environment but still using transactions to ensure consistency– Jack Woodward
Nov 13 '18 at 17:30
You have a few option, using Frank's suggestion you would do a transaction and amend the security rule to say
request.resource.data.votes == resource.data.votes + 1 or you can use another collection to store the vote and then using a cloud function have it update the main document in a trusted environment but still using transactions to ensure consistency– Jack Woodward
Nov 13 '18 at 17:30
with a "cloud function" you mean a function that you have in rules? I have some functions for example to detect if the uses is logged or not but not sure if those cloud functions are something different (sorry, don't really have too much experience with Firebase)
– Daniel Rodriguez
Nov 15 '18 at 22:33
with a "cloud function" you mean a function that you have in rules? I have some functions for example to detect if the uses is logged or not but not sure if those cloud functions are something different (sorry, don't really have too much experience with Firebase)
– Daniel Rodriguez
Nov 15 '18 at 22:33
add a comment |
This should be a fairly basic combination of reading data from the collection and then performing transactions of batched updates. If you're having trouble implementing this, show the minimal code that reproduces where you got stuck.
Definitely also implement Jack's security rules, as those will prevent having to do this again in the future.
answered Nov 13 '18 at 14:53
Frank van PuffelenFrank van Puffelen
229k28374398
hmmm, not sure if I follow you... this should be written on the client side, right? Maybe you're pointing a normal get and post to the ddbb? If so, that's fine, I'm getting at the moment some date and also updating the user but now I have this new property which requires some extra security rules
– Daniel Rodriguez
Nov 13 '18 at 17:29
1
The code to backfill the existing documents can be run on a client, or on a server/Cloud Functions using an Admin SDK. It doesn't really matter where it runs, since you're likely to only run it once, if you follow the advice from Jack.
– Frank van Puffelen
Nov 13 '18 at 17:32
add a comment |
This should be a fairly basic combination of reading data from the collection and then performing transactions of batched updates. If you're having trouble implementing this, show the minimal code that reproduces where you got stuck.
Definitely also implement Jack's security rules, as those will prevent having to do this again in the future.
answered Nov 13 '18 at 14:53
Frank van PuffelenFrank van Puffelen
229k28374398
hmmm, not sure if I follow you... this should be written on the client side, right? Maybe you're pointing a normal get and post to the ddbb? If so, that's fine, I'm getting at the moment some date and also updating the user but now I have this new property which requires some extra security rules
– Daniel Rodriguez
Nov 13 '18 at 17:29
1
The code to backfill the existing documents can be run on a client, or on a server/Cloud Functions using an Admin SDK. It doesn't really matter where it runs, since you're likely to only run it once, if you follow the advice from Jack.
– Frank van Puffelen
Nov 13 '18 at 17:32
add a comment |
This should be a fairly basic combination of reading data from the collection and then performing transactions of batched updates. If you're having trouble implementing this, show the minimal code that reproduces where you got stuck.
Definitely also implement Jack's security rules, as those will prevent having to do this again in the future.
answered Nov 13 '18 at 14:53
Frank van PuffelenFrank van Puffelen
229k28374398
This should be a fairly basic combination of reading data from the collection and then performing transactions of batched updates. If you're having trouble implementing this, show the minimal code that reproduces where you got stuck.
Definitely also implement Jack's security rules, as those will prevent having to do this again in the future.
answered Nov 13 '18 at 14:53
Frank van PuffelenFrank van Puffelen
229k28374398
answered Nov 13 '18 at 14:53
Frank van PuffelenFrank van Puffelen
229k28374398
answered Nov 13 '18 at 14:53
Frank van PuffelenFrank van Puffelen
229k28374398
answered Nov 13 '18 at 14:53
Frank van PuffelenFrank van Puffelen
229k28374398
229k28374398
hmmm, not sure if I follow you... this should be written on the client side, right? Maybe you're pointing a normal get and post to the ddbb? If so, that's fine, I'm getting at the moment some date and also updating the user but now I have this new property which requires some extra security rules
– Daniel Rodriguez
Nov 13 '18 at 17:29
1
The code to backfill the existing documents can be run on a client, or on a server/Cloud Functions using an Admin SDK. It doesn't really matter where it runs, since you're likely to only run it once, if you follow the advice from Jack.
– Frank van Puffelen
Nov 13 '18 at 17:32
add a comment |
hmmm, not sure if I follow you... this should be written on the client side, right? Maybe you're pointing a normal get and post to the ddbb? If so, that's fine, I'm getting at the moment some date and also updating the user but now I have this new property which requires some extra security rules
– Daniel Rodriguez
Nov 13 '18 at 17:29
1
The code to backfill the existing documents can be run on a client, or on a server/Cloud Functions using an Admin SDK. It doesn't really matter where it runs, since you're likely to only run it once, if you follow the advice from Jack.
– Frank van Puffelen
Nov 13 '18 at 17:32
hmmm, not sure if I follow you... this should be written on the client side, right? Maybe you're pointing a normal get and post to the ddbb? If so, that's fine, I'm getting at the moment some date and also updating the user but now I have this new property which requires some extra security rules
– Daniel Rodriguez
Nov 13 '18 at 17:29
hmmm, not sure if I follow you... this should be written on the client side, right? Maybe you're pointing a normal get and post to the ddbb? If so, that's fine, I'm getting at the moment some date and also updating the user but now I have this new property which requires some extra security rules
– Daniel Rodriguez
Nov 13 '18 at 17:29
1
1
The code to backfill the existing documents can be run on a client, or on a server/Cloud Functions using an Admin SDK. It doesn't really matter where it runs, since you're likely to only run it once, if you follow the advice from Jack.
– Frank van Puffelen
Nov 13 '18 at 17:32
The code to backfill the existing documents can be run on a client, or on a server/Cloud Functions using an Admin SDK. It doesn't really matter where it runs, since you're likely to only run it once, if you follow the advice from Jack.
– Frank van Puffelen
Nov 13 '18 at 17:32
add a comment |
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53279265%2fadd-new-property-to-news-documents-on-firebase%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
