How to Test Firestore Security Rules

1# Install dependencies
2npm install --save-dev @firebase/rules-unit-testing vitest
3
4# Create test file
5# tests/firestore.rules.test.ts

1import {
2  initializeTestEnvironment,
3  assertSucceeds,
4  assertFails,
5  RulesTestEnvironment
6} from '@firebase/rules-unit-testing';
7import { doc, getDoc, setDoc, updateDoc, deleteDoc, collection, getDocs } from 'firebase/firestore';
8import { readFileSync } from 'fs';
9
10let testEnv: RulesTestEnvironment;
11
12beforeAll(async () => {
13  testEnv = await initializeTestEnvironment({
14    projectId: 'rules-test-project',
15    firestore: {
16      rules: readFileSync('firestore.rules', 'utf8'),
17      host: '127.0.0.1',
18      port: 8080
19    }
20  });
21});
22
23afterEach(async () => {
24  await testEnv.clearFirestore();
25});
26
27afterAll(async () => {
28  await testEnv.cleanup();
29});

1describe('User profiles', () => {
2  test('authenticated user can read their own profile', async () => {
3    const alice = testEnv.authenticatedContext('alice');
4    const db = alice.firestore();
5    await assertSucceeds(getDoc(doc(db, 'users', 'alice')));
6  });
7
8  test('authenticated user cannot read another user profile', async () => {
9    const alice = testEnv.authenticatedContext('alice');
10    const db = alice.firestore();
11    await assertFails(getDoc(doc(db, 'users', 'bob')));
12  });
13
14  test('authenticated user can create their own profile', async () => {
15    const alice = testEnv.authenticatedContext('alice');
16    const db = alice.firestore();
17    await assertSucceeds(
18      setDoc(doc(db, 'users', 'alice'), {
19        email: 'alice@test.com',
20        displayName: 'Alice',
21        role: 'member'
22      })
23    );
24  });
25
26  test('user cannot create profile for another user', async () => {
27    const alice = testEnv.authenticatedContext('alice');
28    const db = alice.firestore();
29    await assertFails(
30      setDoc(doc(db, 'users', 'bob'), {
31        email: 'bob@test.com',
32        displayName: 'Bob',
33        role: 'member'
34      })
35    );
36  });
37});

1describe('Unauthenticated access', () => {
2  test('unauthenticated user cannot read any profile', async () => {
3    const unauth = testEnv.unauthenticatedContext();
4    const db = unauth.firestore();
5    await assertFails(getDoc(doc(db, 'users', 'alice')));
6  });
7
8  test('unauthenticated user cannot create a post', async () => {
9    const unauth = testEnv.unauthenticatedContext();
10    const db = unauth.firestore();
11    await assertFails(
12      setDoc(doc(db, 'posts', 'post-1'), { title: 'Spam' })
13    );
14  });
15});
16
17describe('Data validation', () => {
18  test('user cannot set role to admin', async () => {
19    const alice = testEnv.authenticatedContext('alice');
20    const db = alice.firestore();
21    await assertFails(
22      setDoc(doc(db, 'users', 'alice'), {
23        email: 'alice@test.com',
24        displayName: 'Alice',
25        role: 'admin' // Should be denied
26      })
27    );
28  });
29
30  test('post title must be a non-empty string', async () => {
31    const alice = testEnv.authenticatedContext('alice');
32    const db = alice.firestore();
33    await assertFails(
34      setDoc(doc(db, 'posts', 'post-1'), {
35        title: '', // Empty string should be denied
36        authorId: 'alice'
37      })
38    );
39  });
40});

1describe('Owner-based access', () => {
2  test('post author can delete their own post', async () => {
3    // Seed a post owned by alice
4    await testEnv.withSecurityRulesDisabled(async (ctx) => {
5      const db = ctx.firestore();
6      await setDoc(doc(db, 'posts', 'post-1'), {
7        title: 'Alice Post',
8        authorId: 'alice',
9        content: 'Hello'
10      });
11    });
12
13    // Now test as alice — should be allowed to delete
14    const alice = testEnv.authenticatedContext('alice');
15    await assertSucceeds(deleteDoc(doc(alice.firestore(), 'posts', 'post-1')));
16  });
17
18  test('non-author cannot delete the post', async () => {
19    // Seed a post owned by alice
20    await testEnv.withSecurityRulesDisabled(async (ctx) => {
21      const db = ctx.firestore();
22      await setDoc(doc(db, 'posts', 'post-1'), {
23        title: 'Alice Post',
24        authorId: 'alice',
25        content: 'Hello'
26      });
27    });
28
29    // Test as bob — should be denied
30    const bob = testEnv.authenticatedContext('bob');
31    await assertFails(deleteDoc(doc(bob.firestore(), 'posts', 'post-1')));
32  });
33});

1describe('Admin access', () => {
2  test('admin can read any user profile', async () => {
3    const admin = testEnv.authenticatedContext('admin-1', { role: 'admin' });
4    const db = admin.firestore();
5    await assertSucceeds(getDoc(doc(db, 'users', 'alice')));
6    await assertSucceeds(getDoc(doc(db, 'users', 'bob')));
7  });
8
9  test('admin can delete any post', async () => {
10    await testEnv.withSecurityRulesDisabled(async (ctx) => {
11      await setDoc(doc(ctx.firestore(), 'posts', 'post-1'), {
12        title: 'Test',
13        authorId: 'alice'
14      });
15    });
16
17    const admin = testEnv.authenticatedContext('admin-1', { role: 'admin' });
18    await assertSucceeds(deleteDoc(doc(admin.firestore(), 'posts', 'post-1')));
19  });
20
21  test('regular user cannot access admin endpoints', async () => {
22    const user = testEnv.authenticatedContext('user-1', { role: 'member' });
23    const db = user.firestore();
24    await assertFails(getDocs(collection(db, 'admin-logs')));
25  });
26});