Skip to content

hidane 0.2.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 12 Oct 09:29
· 127 commits to main since this release
v0.2.0
badc2d7
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

hidane 0.2.0 enforces Security Rules. v0.1 allowed every request; from this release, firestore.rules decides reads, writes, listeners and queries as the official emulator (v1.22.0) does, and each behaviour below was recorded from it and is replayed by the test suite.

Security Rules

  • Compiler: rules versions 1 and 2, function and let, the official error messages and positions, and the type checker's warnings (#59, #60). PUT and GET :securityRules work as they do on the official emulator, so firebase emulators:start, @firebase/rules-unit-testing and the Admin endpoints load rules unchanged (#155).
  • Evaluation: the 14 types and their methods, request and resource (including request.resource.data after field transforms), get() / exists() / getAfter() / existsAfter() with the 10 and 20 call limits, and mock tokens (alg: none) and Bearer owner (#62–#65, #68).
  • Queries: a list or a collection-group query is allowed only when its filter makes every document it may return satisfy the rule, decided with the official emulator's model, constraint values included (#66).
  • Denials: the official PERMISSION_DENIED messages, false for 'get' @ L5, evaluation error at L5:22 … and the rest, over gRPC and REST, the Listen and Write streams included.
  • Diagnostics: :ruleCoverage as JSON and as the HTML report, and debug() output on stdout (#67).

hidane evaluates each condition once. The official emulator evaluates twice and lists the reasons of both passes in a denial (firebase-tools#6252); this and the other intentional differences are in docs/parity-exceptions.md.

Also

  • Documents keep and return their fields in the official emulator's order (#149).
  • npm packages are staged and approved with 2FA instead of published directly (#144); every install channel is checked after each release (#148, #153).

Not yet

The Emulator UI request monitor (#69), event delivery to the Functions emulator (#70), the request fields hidane still lacks (writeFields, inTransaction, … #166) and the remaining coverage-report differences (#167) follow in v0.2.x.

Install

curl -fsSL https://hidane.dev/install.sh | sh
brew install hidane-dev/tap/hidane
npm install --save-dev hidane
cargo binstall hidane   # or cargo install hidane
dart pub global activate hidane
docker run --rm -p 8080:8080 ghcr.io/hidane-dev/hidane:0.2.0

Each archive has a SHA-256 in sha256sums.txt and a build provenance attestation: gh attestation verify <archive> --repo hidane-dev/hidane.

Full changelog: v0.1.0...v0.2.0

Assets 8
Loading