goldibex / targaryen

Test Firebase security rules without connecting to Firebase.
ISC License
242 stars 36 forks source link

Patch does not allow deep updates #120

Closed Maradox closed 7 years ago

Maradox commented 7 years ago

Targaryen Version: 3.0.1

Security Rules:

{
  "rules": {
    "A": {
      "B": {
        "C": {
          "D": {
            ".write": "true"
          }
        }
      },
      "X": {
        "Y": {
          "Z": {
            ".write": "true"
          }
        }
      }
    }
  }
}

The following tests are failing but should succceed: 1.) Update a single path expect().can.patch({B: {C: {D: 10}}}).path('A'); 2.) Update both paths expect().can.patch({B: {C: {D: 10}}, X: {Y: {Z: 20}}}).path('A');

The following code succeeds using firebase with the same security rules: 1.) Update a single path

var data = {};
data["B/C/D"] = 10;
database.ref('A').update(data);

2.) Update both paths

var data = {};
data["B/C/D"] = 10;
data["X/Y/Z/"] = 20;
database.ref('A').update(data);

Summary: Only the full path (e.g.: A/B/C/D ) is writeable. Firebase still allows an update on the node A with the data for B/C/D. Targaryen seems to be more strict and doesn't allow this kind of patch.

dinoboff commented 7 years ago
expect().can.patch({
  B: {C: {D: 10}},
  X: {Y: {Z: 20}}
}).path('A');

Is equivalent on firebase to:

var data = { };
data.B = {C: {D: 10}};
data.X = {Y: {Z: 20}};
database.ref('A').update(data);

Which will fail on firebase.

dinoboff commented 7 years ago

ps: With what you expect patch should do, there no way to have patch test both:

var data = { };
data.B = {C: {D: 10}};
data.X = {Y: {Z: 20}};
database.ref('A').update(data);

and

var data = {};
data["B/C/D"] = 10;
data["X/Y/Z"] = 20;
database.ref('A').update(data);

If you want to test the second operation, use:

expect().can.patch({
  "B/C/D": 10,
  "X/Y/Z": 20
}).to.path('A');
Maradox commented 7 years ago

Thank you for the clarification. It works now.