Cloud Firestore Security Rules for array operations

Question

I'm trying to restrict certain operations towards Firestore to creating or appending to an array. How should I do that? How can I distinguish arrayUnion() from arrayDelete()? What about distinguishing array operations from all the other operations?

Update: So far, from what I got by digging into the Firestore API, I'm guessing maybe something like allow create, FieldValue.arrayUnion: if true could work, but I haven't tested it yet, will update when I tested it.

Answer 1

If you want to ensure that any updates to the document don't remove any f the existing values from the array, you're looking for hasAll:

allow update: if request.resource.data.arrayField.hasAll(resource.data.arrayField);

I just quickly tested this in the simulator. Updating a document that has arrayField: ["value1", "value2"], I:

• Failed when writing arrayField: ["value1"]
• Succeeded when writing arrayField: ["value1", "value2"]
• Succeeded when writing arrayField: ["value1", "value2", "value3"]