correctly get firestore rules by aalej · Pull Request #9829 · firebase/firebase-tools

aalej · 2026-01-28T20:09:13Z

Description

Scenarios Tested

Did some basic testing, but I'll do another round of testing for this just to be thorough since I'm a bit worried about this specific change

this

const release = releases.find((r) => r.name.startsWith(prefix));

to

const release = releases.find((r) => r.name === releaseName);

edit: Done with thorough testing, see manual test cases below

Not sure why we did startsWith
Note:
the getLatestRulesetName method is shared by storage and firestore, so test both
it's also used in rulesDeploy, so test deployments as well

TODO (FIRESTORE TESTING):

Test on a project that does not have Firestore
- Creates rules file with the default template
Test on a project with 1 Firestore database, the (default) one. Should get the (default) rules
- Correctly pulls the rules

downloaded rules

rules_version='2'

// this is the updated rules for this database aalej-9829 \(default\)

service cloud.firestore {
  match /databases/{database}/documents {
    match /{document=**} {
      allow read, write: if request.time < timestamp.date(2026, 3, 1);
    }
  }
}

Test on a project with 1 Firestore database, the (default) one. Deployment updates the rules for the (default) database

Test on a project with multiple Firestore named databases
- Should get the rules for the selected database

"(default)" database selected

rules_version='2'

// this is the updated rules for this database aalej-9829 \(default\)

// deployed on January 30, 2026 at 2:38 AM

service cloud.firestore {
  match /databases/{database}/documents {
    match /{document=**} {
      allow read, write: if request.time < timestamp.date(2026, 3, 1);
    }
  }
}

"non-default" database selected

rules_version = '2';

// this is the updated rules for this database aalej-9829 'non-default'

service cloud.firestore {
  match /databases/{database}/documents {
    match /{document=**} {
      allow read, write: if false;
    }
  }
}

"another-database" database selected

rules_version = '2';

// this is the updated rules for this database aalej-9829 'another-database'

service cloud.firestore {
  match /databases/{database}/documents {
    match /{document=**} {
      allow read, write: if false;
    }
  }
}

Test on a project with multiple Firestore named databases
- Should deploy rules to each database correctly

(default) database

non-default database

another-database database

TODO (STORAGE TESTING):

Test on a project that does not have Storage
- Errors out and asks user to set up storage(requires billing), after set up, able to pull rules
Test on a project that has 1 Storage bucket
- Gets rules from the "default" bucket

downloaded rules

rules_version = '2';

// Craft rules based on data in your Firestore database
// allow write: if firestore.get(
//    /databases/(default)/documents/users/$(request.auth.uid)).data.isAdmin;

// rules for `aalej-9829.firebasestorage.app`

service firebase.storage {
  match /b/{bucket}/o {
    match /{allPaths=**} {
      allow read, write: if false;
    }
  }
}

Test on a project with 1 Storage bucket. Deployment updates the rules for the "default" bucket

Test on a project that has multiple Storage buckets
- Should get rules from the default bucket - This works, turns out you can only get from the "default" bucket, we don't yet have logic to get from other buckets

"default" bucket

rules_version = '2';

// Craft rules based on data in your Firestore database
// allow write: if firestore.get(
//    /databases/(default)/documents/users/$(request.auth.uid)).data.isAdmin;

// rules for `aalej-9829.firebasestorage.app`

// deployed on Feb 3, 2026 at 3:16 AM

service firebase.storage {
  match /b/{bucket}/o {
    match /{allPaths=**} {
      allow read, write: if false;
    }
  }
}

Test on a project that has multiple Storage buckets
- Should correctly deploy to each bucket
  "default" aalej-9829.firebasestorage.app bucket

aalej-9829-another-bucket

aalej-9829-non-default-bucket

REST API Refs
https://firebase.google.com/docs/reference/rules/rest/v1/projects.releases#Release
https://firebase.google.com/docs/reference/rules/rest/v1/projects.releases/list#response-body
https://docs.cloud.google.com/firestore/docs/reference/rest/v1beta1/projects.databases.indexes/list (not really used)

Sample Commands

gemini-code-assist · 2026-01-28T20:09:29Z

Summary of Changes

Hello @aalej, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request refines the mechanism for retrieving Firestore security rules, primarily by correcting the method used to match release names and by introducing support for specifying the target database. These changes aim to ensure that the correct security rules are consistently fetched from the Firebase console, particularly for projects utilizing multiple Firestore databases or when the release naming convention requires an exact match.

Highlights

Precise Release Name Matching: The logic for identifying the latest Firestore ruleset has been updated from a startsWith comparison to an exact === match for release names, ensuring more accurate rule retrieval.
Database ID Support for Rules Retrieval: The function getRulesFromConsole now accepts a databaseId parameter, allowing for the correct fetching of security rules for specific Firestore databases, including handling the special case of the "(default)" database.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request fixes a bug in how Firestore rulesets are retrieved by changing from a potentially incorrect startsWith check to a strict === comparison. It also adds support for fetching rules for named Firestore databases, not just the default one. The changes look correct and improve the reliability of fetching rules. I've added a couple of suggestions to further improve code quality by using const where possible and replacing a magic string with an existing enum for better consistency.

gemini-code-assist · 2026-01-28T20:10:47Z

+  // A named database would have a resource name, and the releases.name looks like:
+  // projects/{project_id}/releases/cloud.firestore/{database_id}
+  const resourceName = databaseId === "(default)" ? undefined : databaseId;
+  const name = await gcp.rules.getLatestRulesetName(projectId, "cloud.firestore", resourceName);


To avoid using a magic string and to improve consistency with other parts of the codebase (like in deploy/firestore), consider using the RulesetServiceType.CLOUD_FIRESTORE enum value instead of the hardcoded string "cloud.firestore". You'll need to import RulesetServiceType from ../../../rulesDeploy.

Suggested change

const name = await gcp.rules.getLatestRulesetName(projectId, "cloud.firestore", resourceName);

const name = await gcp.rules.getLatestRulesetName(projectId, RulesetServiceType.CLOUD_FIRESTORE, resourceName);

TomasMorton · 2026-02-11T19:12:44Z

If you want to avoid the check on the (default) DB string, you could use the GET API instead of the LIST API. The GET API supports the default DB properly. Ultimately your code works though, and probably requires less changes than switching the callers to the GET API.

Referring to: const resourceName = databaseId === "(default)" ? undefined : databaseId;

Example alternative: https://github.com/TomasMorton/firebase-tools/pull/1/changes#diff-39a8ffde64c01915977d645bed074660b58ab4372e5f5c96879c72a940b27a44R127

andersonaddo · 2026-07-08T17:24:26Z

Heya - just popping in. Is the merge conflict the only think preventing this from merging? Or is there another blocker?

aalej · 2026-07-14T18:40:42Z

note: there was a bunch of conflicts(also changes in the functions that were used), gonna do a thorough check of init + deploy(similar to the initially tested scenarios)

aalej · 2026-07-16T13:53:52Z

firestore init works

tested firebase init firestore on different databases. default and named dbs

storage init works

tested firebase init storage. only on default database. we don't have the logic for setting up on different buckets

firestore deploy

tested deployment to (default) database
- updated rules
tested deployment to named databases
- only updates the rules of specified database
tested deployment to all databases simultanously
- updated all database rules

storage deploy

tested deployments to "default" bucket works
- updates rules
tested deployment to specific target
- only updates the rules for the specific bucket
tested deployments to all targets simultanously
- updates all bucket rules

aalej · 2026-07-16T14:06:01Z

+  const release =
+    releases.find((r) => r.name === releaseName) ||
+    releases.find((r) => r.name.startsWith(releaseName));


for context: releases looks something like

[ ... { "name": "projects/PROJECT_ID/releases/cloud.firestore/named-database", "rulesetName": "projects/PROJECT_ID/rulesets/d03b3f12-a8bb-4cf2-a7f2-8b3c7d66ba7a", "createTime": "2026-07-15T12:20:56.470035Z", "updateTime": "2026-07-15T13:53:36.075994Z" }, { "name": "projects/PROJECT_ID/releases/cloud.firestore/github-issue-notifier", "rulesetName": "projects/PROJECT_ID/rulesets/466ec253-979b-4af2-a5b4-6b71371909a0", "createTime": "2025-01-16T13:38:40.781709Z", "updateTime": "2026-05-07T14:58:37.129709Z" }, { "name": "projects/PROJECT_ID/releases/cloud.firestore", "rulesetName": "projects/PROJECT_ID/rulesets/1a92c1f9-4087-455b-902f-69f64f68f3db", "createTime": "2021-06-07T18:11:02.157787Z", "updateTime": "2026-07-15T15:57:18.767569Z" } ... ]

since the default db has a releaseName that looks like projects/PROJECT_ID/releases/cloud.firestore, with

releases.find((r) => r.name.startsWith(releaseName))

it will match anything that starts with projects/PROJECT_ID/releases/cloud.firestore. In this case the named-database release name - projects/PROJECT_ID/releases/cloud.firestore/named-database

Keeping it as a safe fallback in case an exact match isn't found

correctly get firestore rules

a1929c6

aalej marked this pull request as draft January 28, 2026 20:09

gemini-code-assist Bot reviewed Jan 28, 2026

View reviewed changes

aalej added 3 commits February 3, 2026 03:35

add test

e58bc54

Merge branch 'main' into aalej_fix-7981

ce63221

add changelog

2dfdc6c

aalej marked this pull request as ready for review February 2, 2026 19:51

Merge branch 'main' into aalej_fix-7981

6c5fe27

aalej requested a review from joehan February 3, 2026 10:17

TomasMorton mentioned this pull request Feb 17, 2026

Firebase Rules Deploy may not deploy rules when project has multiple databases #9910

Open

joehan approved these changes Apr 13, 2026

View reviewed changes

Merge branch 'main' into aalej_fix-7981

a5f221f

aalej added 2 commits July 15, 2026 02:26

Merge branch 'main' into aalej_fix-7981

43a3b31

fix conflicts

888a33c

aalej added 2 commits July 16, 2026 21:50

get correct rules

861a7c6

Merge branch 'main' into aalej_fix-7981

a63efd5

aalej commented Jul 16, 2026

View reviewed changes

aalej requested a review from joehan July 16, 2026 15:46

Merge branch 'main' into aalej_fix-7981

8d043bf

joehan approved these changes Oct 22, 2026

View reviewed changes

joehan enabled auto-merge (squash) October 22, 2026 20:53

Merge branch 'main' into aalej_fix-7981

286a132

Navigation Menu

Repository navigation

correctly get firestore rules - #9829

correctly get firestore rules#9829
aalej wants to merge 12 commits into
mainfrom
aalej_fix-7981

aalej commented Jan 28, 2026 •

edited

Loading

Uh oh!

gemini-code-assist Bot commented Jan 28, 2026

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

Uh oh!

gemini-code-assist Bot Jan 28, 2026

Uh oh!

TomasMorton commented Feb 11, 2026 •

edited

Loading

Uh oh!

andersonaddo commented Jul 8, 2026

Uh oh!

aalej commented Jul 14, 2026

Uh oh!

aalej commented Jul 16, 2026

Uh oh!

aalej Jul 16, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

	const name = await gcp.rules.getLatestRulesetName(projectId, "cloud.firestore", resourceName);
	const name = await gcp.rules.getLatestRulesetName(projectId, RulesetServiceType.CLOUD_FIRESTORE, resourceName);

Conversation

aalej commented Jan 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Scenarios Tested

Sample Commands

Uh oh!

gemini-code-assist Bot commented Jan 28, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

gemini-code-assist Bot Jan 28, 2026

Choose a reason for hiding this comment

Uh oh!

TomasMorton commented Feb 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

andersonaddo commented Jul 8, 2026

Uh oh!

aalej commented Jul 14, 2026

Uh oh!

aalej commented Jul 16, 2026

firestore init works

storage init works

firestore deploy

storage deploy

Uh oh!

aalej Jul 16, 2026

Choose a reason for hiding this comment

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

aalej commented Jan 28, 2026 •

edited

Loading

TomasMorton commented Feb 11, 2026 •

edited

Loading