Cloud Firestore andRealtime Database both rely on powerful, concise rules languagesspecifically created to govern information security and access control. However,as rules get longer and more complex, you might need some help debugging errorsin their behavior.

The Firebase Emulators include the ability to generate rule coverage reports, so youcan see see exactly what each subexpression evaluated to when you reproducean error. The reports also provide information about how frequently each testcase used a rule, like traditional "line coverage" techniques.

Generate a report

After running a suite of tests, you can access testcoverage reports that show how each of your security rules was evaluated.

To get the reports, query an exposed endpoint on the emulator whileit's running. For a browser-friendly version, use the following URL:

http://localhost:8080/emulator/v1/projects/<database_name>:ruleCoverage.html

http://localhost:9000/.inspect/coverage?ns=<database_name>

This breaks your rules into expressions and subexpressions that you canmouseover for more information, including number of evaluations and valuesreturned. For the raw JSON version of this data, include the following URLin your query:

http://localhost:8080/emulator/v1/projects/<database_name>:ruleCoverage

http://localhost:9000/.inspect/coverage.json?ns=<database_name>

Debugging example rules

To easily generate a test report, use the emulator quickstarts available onGitHub forCloud Firestore andRealtime Database.These quickstarts guide you through properly installingand initializing the emulators, then generating sample tests from an exampleset of rules.

Consider an example app usingCloud Firestore that counts how many times usersclick a button. The app employs the following rules:

servicecloud.firestore{match/databases/{database}/documents{match/counters/{counter}{allowread;allowwrite:ifrequest.resource.data.value==resource.data.value+1;}}}

To debug the errors in the rules shown above, use the following sampleJavaScript test:

constcounter0=db.collection("counters").doc("0");awaitfirebase.assertSucceeds(counter0.set({value:0}));

The emulator generates a report available at the URL noted above:

http://localhost:8080/emulator/v1/projects/<database_name>:ruleCoverage.html

The report shows the following undefined and null-value errors:

The problem with this specific example is that the rules don't differentiatebetween creating the document and updating the document. Consequently, thewrite isn't allowed if the document doesn't exist, and the document can't becreated because it doesn't exist. Differentiating the "write" into twomore specific operations — "create" and "update" — solves the problem.

servicecloud.firestore{match/databases/{database}/documents{match/counters/{counter}{allowread;allowcreate:ifrequest.resource.data.value==0;allowupdate:ifrequest.resource.data.value==resource.data.value+1;}}}

The generated report shows how frequently each rule was used and what wasreturned.