‫-: Hi.
‫Within this lecture
‫we are going to deep dive
‫into the Firestore security rules,
‫so that we can make our
‫firebase app perfectly safe.
‫So far we have actually
‫implemented a condition,
‫in the write part, okay?
‫And we didn't do anything for the read part,
‫and we are going to see how to create functions,
‫and how to implement, update,
‫and delete operations in here, as well.
‫For example,
‫right now we only have read and write
‫for, for some purpose
‫I want to maybe, allow updating
‫or deleting, with conditions, as well.
‫So I'm going to say allow update,
‫and I'm going to say allow delete.
‫So this is good.
‫Maybe, we don't want to delete anything.
‫Then I can just say allow delete false,
‫but I'm not gonna do that.
‫Maybe, I just want to check if the request.auth
‫is not now in every condition,
‫but if I wanna do that,
‫if I want to check for authentication
‫in every procedure,
‫maybe, it's better for me
‫to create a function for that.
‫So, under match,
‫I'm going to write function, okay?
‫So I'm writing this under match,
‫not inside of the match,
‫as you can see,
‫I'm outside of this curly braces,
‫but I'm inside of this match curly braces.
‫Okay?
‫So think does like a class,
‫and I'm writing the function over here.
‫So I'm going to call
‫our function is authenticated,
‫or is signed in.
‫So this function will actually
‫return the condition of
‫whether this is authenticated or not.
‫So I'm gonna call this, is,
‫isSignedIn, like this, okay?
‫And this is not very different
‫from writing a function
‫in Java or in Swift.
‫So all you have to do is
‫just open this curly braces,
‫and this is your coding block right now.
‫So we what, what you wanna return over here
‫is the authentication states of the current request.
‫So I'm going to say return request.auth,
‫and is not null of course.
‫So if this is not null,
‫it means that it's authenticated.
‫So rather than saying request.auth is not null,
‫right now I can actually say,
‫if isSignedIn, right?
‫So this will make our code very easy like this.
‫So I'm going to allow write,
‫only, and only if,
‫the user is signed in,
‫and I'm checking this
‫in a function like that.
‫So it's pretty straightforward, right?
‫So you can just create your own function like this.
‫Now the way that you want
‫and you can do the same thing for update,
‫you can do the same thing for delete,
‫and you can actually,
‫do the same thing for read, as well.
‫But in this case,
‫I'm not going to do this for reading, okay?
‫And over here, we don't need any same column, right?
‫Like that.
‫Okay?
‫And let's do that actually,
‫let's add the if isSignedIn condition,
‫in update, and delete, and leave the read alone.
‫So we will allow reading in every instance,
‫and we will allow updating,
‫if isSignedIn, like this.
‫Okay? And here you go.
‫We are going to allow deleting if isSignedIn.
‫So, so far so good,
‫and I'm going to save this, like that.
‫And here you go.
‫Now we have a complete, working, secure app.
‫Maybe it's not secure, as much as you want.
‫For example,
‫maybe you may want to check one more condition.
‫Like what?
‫Like maybe,
‫you may want to allow deleting or updating,
‫if and only if,
‫you are dealing with the current user, right?
‫So what do I mean?
‫For example, if I tweet something,
‫and if I want to update it,
‫or delete it, okay,
‫I can check for the UID.
‫So if you say request that auth.UID,
‫it means that request is coming from this user.
‫So remember,
‫every user has its own user unique IDs.
‫And in order to check that,
‫of course, you need to actually store
‫it in Firestore database.
‫Like in the tweets,
‫right now unfortunately,
‫we only have the user emails,
‫rather than user IDs.
‫It's a good idea to include the user UIDs,
‫in the user,
‫or in the tweet Firestore over here,
‫so that we can get this data,
‫and check it,
‫cross reference it, like over here.
‫So, we don't have that,
‫but it's not going to be problem for us.
‫I'm just going to show you how to do that,
‫like pretending that user email is our user ID.
‫Okay?
‫So if you wanna do that,
‫make sure you include user IDs
‫in your own Firestore app,
‫when you try to create something like that.
‫And this is generally the case when you try with
‫a social app.
‫So whether you're posting a picture,
‫whether you're posting a tweet,
‫or something like that,
‫maybe you may want to allow
‫only the user itself to update
‫or change the data, right?
‫So for example,
‫I'm just going to assume
‫that we want to update the data,
‫if and only if, the user is signed in,
‫and, also, if and only if,
‫user is authenticated,
‫and the, the request is coming
‫from the same user.
‫So maybe we can create a function,
‫like isOwner for that, as well.
‫So over here,
‫I'm going to check
‫for the request.auth.uuid, UID, right?
‫So I'm going to return this, okay?
‫So I'm going to do the same thing.
‫I'm going to return it value,
‫and this value will be the
‫request.auth.UID itself.
‫Then, I'm going to check
‫if this is the same UID, like this,
‫okay?
‫And I'm going to check to see
‫if this is equal to
‫request that UUID.
‫And in order to do that,
‫actually we are going to take
‫in some parameter over here,
‫like a mail.
‫Okay?
‫I'm going to say mail over here,
‫and mail over there, okay?
‫And we're going to pass that parameter,
‫pass that input, from the above rules.
‫You will see what I mean in a minute,
‫and it will check to see if this is true or not.
‫Okay?
‫And what I'm going to do,
‫I'm going to come over here
‫to update function,
‫and say an and operant over here.
‫So this will check,
‫if isSignedIn and if isOwner, as well.
‫So over here,
‫I need to pass in a parameter, like email.
‫So I'm going to say user email,
‫which is the thing that I have
‫in my account, in my Firestore database.
‫Actually it would be much more easier
‫if you had the UID in your Firestore as I said before.
‫But right now, just for test purposes
‫I'm just gonna do this,
‫okay, isOwner user email.
‫So this will crosscheck,
‫if the user ID is actually match, is a match,
‫and if it's a match, it'll update the value.
‫Or if it's not a match, it won't update the value.
‫Okay?
‫It will check for this user UID.
‫So this is how you create security rules.
‫This is how you create custom functions
‫inside of your security rules.
‫You don't have to create these custom functions,
‫it's just for test purposes.
‫It's just for educational purposes only,
‫right now.
‫But if you want to do that,
‫you can use this same thing,
‫you can use the same structure,
‫in order to create your own,
‫and this will make your app much more secure.
‫This will make your app vulnerable against
‫this risk call attacks,
‫so that people cannot download
‫your entire database
‫or change it in a way they want.
‫So I believe this section was one
‫one of the most important sections of the course,
‫because you have learned a lot of new skills.
‫I hope you enjoyed it.
‫We're gonna stop here
‫and continue with a CTF challenge.