Firestore Security - allow only known fields

Question

I can’t figure out how to properly set the ‘.validate’ rule in Firestore. Basically, I want to allow a User document to contain only the fields I know:

Answer 1

To add on to Mike McDonald's answer, to check for particular keys, the form is now:

request.resource.data.keys().hasAll

instead of

request.resource.data.hasAll

Full example:

// allows for creation with name and phone fields
allow create: if request.resource.data.size() == 2
              && request.resource.data.keys().hasAll(['name', 'phone'])
              && request.resource.data.name is string
              && request.resource.data.phone is string;
// allows a single update adding the address field
// OR (||) in additional constraints
allow update: if request.resource.data.size() == resource.data.size() + 1
              && !('address' in resource.data)
              && request.resource.data.address is string;

More information here: https://firebase.google.com/docs/reference/rules/rules.Map