In this lecture, we're going to review the rules for the Firebase storage service.
There are some modifications I'd like to make before moving forward.
You can find the rules under the Rules tab in the storage section of the Firebase console.
You'll come across a page similar to mine.
The rules may look familiar to you because they use a similar syntax as the database rules.
So let's run through them line by line.
The first line is setting the version.
Different versions support different syntax rules and features.
Version two is the latest.
It's the version we'll be working with in this course.
The following line is selecting the Firebase storage service.
The rules written inside the curly brackets will be applying to this service.
Anything inside curly brackets is grouped together.
We're able to apply some rules or make some further selections afterward.
We're using the match keyword to instruct the rules to select any bucket in the Firebase application.
The bucket variable is a placeholder for the current bucket being accessed.
Firebase allows you to create multiple buckets, but the free version limits us to one another.
Match is made for any paths inside the buckets.
You can think of both match statements as wildcard selections.
Lastly, we're adding rules to both the read and write permissions.
Requests performed by non authenticated users will be rejected.
There's one thing I want to note about this rule we didn't have to tell Firebase that the user was authenticated.
There wasn't anything we needed to do on our part.
That's the beauty of using the SDK.
It's able to send the token with our requests.
Earlier, I stated that I wanted to modify the rules Firebase has provided us.
There are three changes we're going to make.
First, we want to allow anyone to access the files.
Visitors should be able to watch clips without having an account.
However, we want to continue to limit upload permissions to authenticated users.
Secondly, we want to check the file type.
We performed validation on the client, but it doesn't hurt to perform it on the server.
The third thing we'll check for is the file size.
We want to limit how large a file can be because storage space is limited.
A single file can theoretically increase the bill.
Setting a file size limit can prevent that from happening.
Server validation is an action to be performed by a back end developer of your application.
This step isn't necessary, but if you plan on using Firebase for your applications, this may be nice
to know.
If you don't plan on using Firebase, you can skip this part and move on to the next lecture in the
rules.
We're going to separate the read and write rules.
Currently, they're combined into one rule.
The Reid Rule will be updated to allow anyone to read the files.
We aren't too concerned with the contents of the files being uploaded.
We won't be storing files that require restrictions.
You can add rules for that if you'd like, but it's unnecessary for this application for the right rule.
We want to continue to check if the user is authenticated.
We're going to add on to this by checking for the type and file size.
We can add additional conditions by using double ampersand symbols.
The second statement will be the following request Dot Resource Dot Content Type equals equals video
slash MP for.
The request object refers to the request being made to the Firebase storage service, we're accessing
the resource object, which represents the file being uploaded.
We're using the resource to grab the content type of the file.
This object is where the mime type is stored.
We're checking if its value is equal to video slash MP for this condition takes care of checking the
file type.
The following conditions should check for the file size.
Add another condition to the right rule.
The condition will be the following request Typekit Resource Excise Less than 10 asterisk one thousand
asterisk one thousand.
We're using the resource object again.
It has another property called size, the science property stores the size of the file.
The size is measured bites.
We're checking if the size is less than the equation on the right.
The equation we're using will calculate the maximum upload size in megabytes.
There are 1000 bytes and akilah byte and there are 1000 kilobytes in a megabyte.
This condition will limit the maximum upload file size two megabytes.
If a file is larger than that, the file will be rejected if the file is rejected.
Firebase will throw an error will handle errors in a future lecture.
If the three conditions return true, the file will get uploaded.
There is one cool trick I want to show you before we publish the changes.
The second condition is checking for the file type.
In some cases, you may want to allow multiple types.
Writing each type can be cumbersome.
Firebase has a function for checking multiple types if they're in a similar category.
Instead of checking the type, we can run a function on the content type property called matches.
This function allows you to pass in a time with a wild card.
For example, we can pass in video slash asterisk.
This is a custom function defined by the Firebase API.
It'll shake off the type is in the video category.
The asterisk character acts as a wildcard.
It'll allow for any subtype for this course.
We're going to be dealing exclusively with MP for files.
I'm going to revert this condition back to the original.
If you would like more information about these values, you can check out the link I provided in the
resource section of this lecture.
This documentation page will provide the details you'll need to secure files in your bucket.
Back in the Firebase console, we're going to publish the rules.
Make sure your rules match mine.
The rules have been published.
We should still be able to continue to upload files.
Try testing out the uploader.
We won't be able to see if the upload was a success because we haven't handled the response.
Switch to the console to check the storage for the file.
The file was successfully uploaded great, we're able to continue uploading files, but with additional
restrictions in place in the next couple of lectures will continue working with the uploader.