Firestore Security - allow only known fields

Question

I can’t figure out how to properly set the ‘.validate’ rule in Firestore. Basically, I want to allow a User document to contain only the fields I know:

Answer 1

You're looking for both the size() and hasOnly() methods.

allow write: if request.resource.data.size() == 3 
             && request.resource.data.keys().hasOnly(['name', 'phone', 'address'])

Using size() allows you to ensure an exact number of fields. Combining that with hasOnly() allows to you lock it to those specific fields.

You can read more in the Cloud Firestore Rules reference docs.