How to enforce values in a map in Firestore rules without knowing the keys?

Question

I'm trying to implement something similar to "Working with Arrays, Lists, and Sets" example in Firestore's document, but for user access control list.

In a document, there'll be a modified field of a timestamp, and a users field of a map, containing user's UID as a key and the modified timestamp as value (so that I can sort using this field).

{
    modified: 2018-01-01T17:05:00Z,
    users: {
        someUID: 2018-01-01T17:05:00Z,
        otherUID: 2018-01-01T17:05:00Z
        /* ... */
    }
}

It's obvious that I have to keep the values inside users map in sync with the modified field. As I don't want to pay a cloud function call and a document write whenever the document is updated, I plan to do the update on the client, at the same time the document itself is updated.

The question is, how can I enforce, using Firestore security rules, the values of users map so that it'll always be in sync with the modified field? The keys of this map isn't known in advance, and the size of this map can be variable, too.

Answer 1

You can use writeFields for update rules if map is variable or keys are unknown while updating.

allow update: if request.auth != null
     && request.resource.data.users is map
     && request.writeFields.size() == 1
     && (('users.' + request.auth.uid) in request.writeFields)
     && request.resource.data.users[request.auth.uid] <= request.time.time();