rules_evaluate
Evaluate Firestore or Storage security rules for a proposed get, list, write, or delete request; return allow/deny verdict, deciding rule line, and expression values without writing data.
Instructions
Ask the rules in force (or a draft) whether a request would be allowed: get, list, create, update or delete on a Firestore path or Storage object as a given user or unauthenticated; returns the verdict, the rule line that decided it and each evaluated expression's value. Nothing is written.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| uid | No | Act as this signed-in user; omit for an unauthenticated request | |
| data | No | Firestore create/update: the written fields as plain JSON (update: the fields set over the existing document) | |
| path | Yes | Firestore document path (a collection path for list), or the Storage object name (a folder ending in / for list) | |
| time | No | request.time as RFC 3339; default now | |
| limit | No | Firestore list: the query limit | |
| where | No | Filters combined with AND | |
| bucket | No | Storage bucket; default the default bucket | |
| claims | No | request.auth.token: custom claims and token fields (email, firebase.sign_in_provider...) | |
| method | Yes | The operation | |
| object | No | Storage create/update: the proposed object | |
| source | No | Evaluate this draft rules source instead of the rules in force | |
| idToken | No | Act as the user of this emulator ID token (from auth_mint_token) instead of uid/claims | |
| orderBy | No | Sort keys | |
| service | No | Which rules: firestore (default) or storage | |
| database | No | Firestore database id; default (default) | |
| existing | No | Firestore: the document before the request as plain JSON, or null for none; default the stored document | |
| collectionGroup | No | Firestore list: a collection-group query on the path's last collection id |