The critical configuration.
WHAT THEY DO
Determine what each client may read and write, evaluated on every request.
WHY THEY ARE CRITICAL
Clients talk to the database directly. Rules are the only thing between a user and all your data.
WHAT THE COMMONEST SERIOUS MISTAKE IS
Rules left open from development.
WHAT THAT MEANS
Anyone can read or write everything.
WHY IT HAPPENS
Test mode permits everything, and the change is never made.
WHAT TO WRITE
Deny by default, permitting specific access explicitly.
WHAT RULES SHOULD ENFORCE
That a user may only access their own data That required fields exist and have correct types That fields the user must not control cannot be set
WHY THAT LAST POINT
Without it, a client sets its own role, balance or status.
WHAT TO REMEMBER ABOUT QUERIES
Rules are not filters. A query that could return documents the user cannot read is rejected entirely.
WHAT THAT MEANS
Queries must be written to match what the rules permit.
WHAT TO TEST
Rules, with the emulator and automated tests.
WHAT TO REVIEW
Rules, after every data model change.
WHAT TO ENFORCE SERVER-SIDE
Anything involving money, permissions or other users.
