firebase / firebase/firebase-tools

Deploying storage rules that contain cross service access without permission in non-interactive mode will not fail

Open
#5,519 0 comments 0 reactions 0 assignees View on GitHub
api: storage type: bug
Dominant language
TypeScript
Stars
4.5k
Forks
1.3k
Avg merge
1d 12h
Merged PRs (30d)
84

Description

### Description

I think that it is basically not expected that rules will be deployed without permission.

I think `non-interactive` is supposed to be an option when deploying with CI.

So it should fail if there is no `force` option.

https://github.com/firebase/firebase-tools/blame/master/src/rulesDeploy.ts#L117-L120

### [REQUIRED] Environment info

**firebase-tools:** 11.21.0

**Platform:** Windows (msys2)

### [REQUIRED] Test case

```
rules_version = '2';
service firebase.storage {
match /b/{bucket}/o {
match /{allPaths=**} {
allow read, write: if firestore.exists(/databases/(default)/documents/users/$(request.auth.id));
}
}
}
```

### [REQUIRED] Steps to reproduce

`firebase deploy --only storage --non-interactive`

### [REQUIRED] Expected behavior

Command failed

### [REQUIRED] Actual behavior

```bash
i storage: uploading rules storage.rules...
+ storage: released rules storage.rules to firebase.storage
```

Contributor guide

Open the contributing guide

Research direction

Start with src/rulesDeploy.ts around lines 117-120 and inspect how non-interactive deployments handle cross-service storage rules and the force option. Reproduce with the provided rules and run firebase deploy --only storage --non-interactive. Done means the command fails when force is absent, while the issue's expected behavior is preserved.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
cli
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.