goldibex / targaryen

Test Firebase security rules without connecting to Firebase.
ISC License
242 stars 36 forks source link

Perform deep equality check when using == #133

Closed zhouzi closed 7 years ago

zhouzi commented 7 years ago

When using ==, Firebase performs a deep equality check.

For example, if you wanted to ensure equality of two objects stored in different points of the JSON tree:

type User {
     uid: String,
     firstName: String,
     lastName: String,

     create() {
         this == root.somewhereElse[uid]
    }
}

With this rule, Firebase will disallow creating objects that are not strictly equal.

Though it's not really documented: https://firebase.google.com/docs/reference/security/database/#equals

=== (equals) Used to check if two variables in a rules expression have the same type and value.

dinoboff commented 7 years ago

That's interesting, I didn't know firebase could compare object. I will add tests and fix that later today.

ps: currently, it treats == and === both as strict equality.

dinoboff commented 7 years ago

@Zhouzi Do you have a test I can try in the simulator?

I tries with:

It fails for me.

zhouzi commented 7 years ago

I just spent some time giving it another try and apparently I was mistaking. I debugged the code that led me to think that Firebase was performing a deep equality check and I was whether testing it wrong or using the admin SDK (which doesn't care about rules).

Sorry for bothering 😞

dinoboff commented 7 years ago

No problem. AFAIK, the only way to compare random object properties is with:

{
  "rules": {
    "bar": {
      ".write": "newData.exists()",
      "$key": {
        ".validate": "newData.parent().parent().child('foo').child($key).val() == newData.val()"
      }
    }
  }
}