Resource and request objects in Firebase - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

What is the output of this Firebase Firestore security rule evaluation?

Given the following Firestore security rule snippet, what will be the result of a read request if the document's field ownerId matches the request.auth.uid?

Firebase

service cloud.firestore {
  match /databases/{database}/documents {
    match /users/{userId} {
      allow read: if resource.data.ownerId == request.auth.uid;
    }
  }
}

A The read request is allowed only if the userId path variable matches request.auth.uid.

B The read request is always allowed regardless of the authenticated user.

C The read request is denied because resource.data is not accessible in read rules.

D The read request is allowed only if the authenticated user's ID matches the document's ownerId.

💡 Hint

Remember that resource.data refers to the existing document data and request.auth.uid is the authenticated user's ID.

The rule allows read access only if the document's ownerId field matches the authenticated user's ID. This ensures users can only read their own documents.

🧠 Conceptual

intermediate

Which Firebase request object property contains the data sent by the client in a write operation?

In Firebase security rules, when a client tries to write data, which property of the request object holds the new data the client wants to write?

A request.resource.data

B request.data

C request.auth.token

D request.writeData

💡 Hint

Think about the difference between resource and request.resource.

request.resource.data contains the data the client wants to write. resource.data is the existing data before the write.

❓ Architecture

advanced

Which Firebase security rule correctly restricts document deletion to the document owner only?

You want to allow only the owner of a document to delete it. The document has a field ownerId. Which rule correctly enforces this?

A allow delete: if request.auth.uid == resource.data.ownerId;

B allow delete: if request.resource.data.ownerId == request.auth.uid;

C allow delete: if request.auth.uid != resource.data.ownerId;

D allow delete: if request.auth.token.owner == resource.data.ownerId;

💡 Hint

Remember that resource.data is the current document data before deletion.

For deletion, resource.data holds the existing document data. The rule checks if the authenticated user is the owner.

❓ security

advanced

What error occurs if you try to access resource.data in a create request where the document does not exist yet?

In a Firestore security rule for a create operation, what happens if you try to read resource.data?

A It returns the data being created from <code>request.resource.data</code>.

B It causes a runtime error because <code>resource.data</code> is undefined on create.

C It returns null because the document does not exist yet.

D It returns an empty map {}.

💡 Hint

Think about the difference between existing data and new data during create.

On create, resource.data is null because the document does not exist yet. Accessing it returns null, not an error.

✅ Best Practice

expert

Which Firebase security rule snippet best prevents unauthorized updates to a user's email field?

You want to allow users to update their documents but prevent them from changing the email field. Which rule snippet enforces this correctly?

A allow update: if request.auth.uid == resource.data.ownerId && request.resource.data.email == request.auth.token.email;

B allow update: if request.resource.data.email == resource.data.email;

C allow update: if request.resource.data.email != resource.data.email;

D allow update: if request.auth.uid == resource.data.ownerId;

💡 Hint

Compare the new email field with the existing one to detect changes.

Option B ensures the email field is unchanged during update, preventing unauthorized modifications.

Practice

1. What does a request object in Firebase functions mainly contain?

easy

A. Logs of previous function executions

B. Details about the data or file that triggered the function

C. Settings for Firebase project configuration

D. Information about what the user sent and how

Solution

1. Step 1: Understand the role of request objects

   The request object holds details about the user's input and request method.

2. Step 2: Differentiate from resource objects

   Resource objects describe the trigger data or file, not user input.

3. Final Answer:

   Information about what the user sent and how -> Option D

4. Quick Check:

   Request object = user input info [OK]

Hint: Request = user input details, Resource = trigger data [OK]

Common Mistakes:

• Confusing resource object with request object
• Thinking request holds trigger file info
• Assuming request contains project settings

2. Which of the following is the correct way to access the data sent by a user in a Firebase HTTPS function's request object?

easy

A. request.data.body

B. request.body.data

C. request.payload

D. request.trigger.data

Solution

1. Step 1: Recall request object structure

   In Firebase HTTPS functions, user data is inside request.body.

2. Step 2: Identify correct property for user data

   The user data is accessed as request.body.data if data is nested inside body.

3. Final Answer:

   request.body.data -> Option B

4. Quick Check:

   Access user data via request.body.data [OK]

Hint: User data is inside request.body in HTTPS functions [OK]

Common Mistakes:

• Using request.data.body which is invalid
• Trying to access request.payload which doesn't exist
• Confusing trigger data with request data

3. Given this Firebase function snippet:

exports.myFunction = functions.storage.object().onFinalize((object, context) => {
  console.log(object.name);
  console.log(context.eventId);
});

What does the object parameter represent?

medium

A. The Firebase project configuration

B. The user's HTTP request data

C. The file that triggered the function

D. The function's execution logs

Solution

1. Step 1: Identify the trigger type

   The function triggers on a storage object finalization, meaning a file event.

2. Step 2: Understand the object parameter

   The object parameter holds info about the file that triggered the function.

3. Final Answer:

   The file that triggered the function -> Option C

4. Quick Check:

   Storage trigger object = file info [OK]

Hint: Storage triggers pass file info as object parameter [OK]

Common Mistakes:

• Thinking object is user request data
• Confusing context with resource object
• Assuming object holds config or logs

4. Identify the error in this Firebase HTTPS function code:

exports.func = functions.https.onRequest((resource, request) => {
  console.log(request.body);
});

medium

A. Parameters are reversed; should be (request, response)

B. Missing return statement

C. Incorrect function name

D. No error; code is correct

Solution

1. Step 1: Check HTTPS function parameters

   HTTPS functions receive (request, response) parameters in that order.

2. Step 2: Identify parameter misuse

   The code uses (resource, request) which reverses and misnames parameters.

3. Final Answer:

   Parameters are reversed; should be (request, response) -> Option A

4. Quick Check:

   HTTPS function params = (request, response) [OK]

Hint: HTTPS functions always use (request, response) parameters [OK]

Common Mistakes:

• Swapping request and response parameters
• Using resource parameter in HTTPS function
• Ignoring parameter order importance

5. You want to write a Firebase function triggered by Firestore document changes. Which object should you use to access the changed document's data inside the function?

hard

A. resource.after.data()

B. request.body

C. context.params

D. resource.data()

Solution

1. Step 1: Understand Firestore trigger parameters

   Firestore triggers receive a change object with before and after snapshots.

2. Step 2: Access the new document data

   The updated document data is accessed via change.after.data(), which is the resource object.

3. Final Answer:

   resource.after.data() -> Option A

4. Quick Check:

   Firestore change after data = resource.after.data() [OK]

Hint: Use resource.after.data() for updated Firestore document data [OK]

Common Mistakes:

• Using request.body which is for HTTP functions
• Using context.params which holds path variables
• Using resource.data() which is old snapshot, not updated