Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Security Rules Unit Testing Pipeline Integratio...

Security Rules Unit Testing Pipeline Integration for Firestore

Making sure the quality of our apps and web to be stable all the time would be challenging especially for critical issue such as security rules, here we will talk about how developers can integrate their security rules for cloud firestore within a pipeline integration for continuous deployment for a modern web application. We will get to know about Firebase Security Rules, Firebase Rules Testing Library. Firebase Emulator Suite, Cloud Firestore and Github Pipeline Integration.

Firebase Thailand

April 01, 2023
Tweet

More Decks by Firebase Thailand

Other Decks in Technology

Transcript

  1. Security Rules Unit Testing Pipeline Integration for Firestore Google Developer

    Expert in Firebase Surahutomo Aziz Pradana Firebase Dev Day 2023 GDG Bangkok Firebase Thailand Organized by
  2. ? Anonymous Security Rules Realtime Database Firestore Storage Google Server

    - Prebuilt public and private key to prevent anomaly access X
  3. ? Anonymous Security Rules Realtime Database Firestore Storage Google Server

    - Prebuilt public and private key to prevent anomaly access - Prebuilt protect from any malicious attack X
  4. Admin Security Rules Realtime Database Firestore Storage Google Server -

    Updating the wrong record accidentally - Manipulating the data or fraud X
  5. Admin Security Rules Realtime Database Firestore Storage Google Server -

    Updating the wrong record accidentally - Manipulating the data or fraud - Hacked admin account for suspicious action X
  6. Developer Security Rules Realtime Database Firestore Storage Google Server -

    Prevent bugs by protecting code payload consistency X
  7. rules_version = '2'; service cloud.firestore { match /databases/{database}/documents { match

    /members/{memberId} { allow write: if hasKey(["uid"]) } } } firestore.rules
  8. Developer Security Rules Realtime Database Firestore Storage Google Server -

    Prevent bugs by protecting code payload consistency - Prevent bugs when dev forget the specific rule in user flow journey X
  9. rules_version = '2'; service cloud.firestore { match /databases/{database}/documents { function

    withSpecialCondition(role) { // return some special condition } match /members/{memberId} { allow write: if withSpecialCondition("special_role") } } } firestore.rules
  10. Developer Security Rules Realtime Database Firestore Storage Google Server -

    Prevent bugs by protecting code payload consistency - Prevent bugs when dev forget the specific rule in user flow journey - Increase code quality by using strong and centralized data flow and its operation X
  11. rules_version = '2'; service cloud.firestore { match /databases/{database}/documents { function

    someFunction(role) { // return some function logic } match // collection name 1 { allow write: if // some condition 1 } match // collection name 2 { allow read: if // some condition 2 } } } firestore.rules
  12. Oh nooo! I have a product demo in a minute,

    I need to rush and finish this code ! Long time ago …
  13. OKAY! This time i concentrated and not underestimate the code

    changes, looks fine! Long time ago …
  14. Oh my, it breaks my code, the library has changed

    its implementation and i didn’t realize it :( Then …
  15. At least there are 3 levels Tech Testing Auto Building

    the security Testing the security level Automate the testing process Minimize human error by building this! So ..
  16. Steps : • Build our testing for security rules •

    Automate running the security rules testing • Protect the branch with the automation !