Implementing an increment(+1) filed security using security rules - google-cloud-firestore

I want to be able to protect my increment logic from being abused from the front end
my current frond end code
// Initial Payload
const surfacePayload: SurfacePayload = {
gender: selected.gender,
unit: unit.current,
// will increment the count in db by +1
count: increment(+1),
src: currentUser?.uid!,
};
await setDoc(doc(db, docRef, surfacePayload);
my security rules logic is like the following :
// requestData.count types
request.resource.data.count is number && // if the incoming count is a number
request.resource.data.count <= 12 && // this field cannot exceed 12
my big concern however is the this counter is set as a protector for creating docs in a related sub-collection, and it is really ease to keep sending 0 or 1 there is no real check whether the incoming data are only (increment +1)added to the current state of the count in doc... is there any other check that I can implement to make it rock solid, I tried to check again the current state using only (resource.data) but since this check is a part of a bigger check and it is chained so it has failed..

For the case where your document might not exists at first place, you can write separate rules for create and update as shown below:
allow create: if request.resource.data.count == 1; // default value 1
allow update: if request.resource.data.count == resource.data.count + 1;

Related

Counter for re-opened cases - Salesforce

I'm traying to create a trigger that count each time a case is re-opened.
What I need is that changing the Status "Cerrado" to "Asignado" add +1
I've this trigger but it doesn't working at all.
Reperturas__c a type number and in the formula I've a 0.
"Cerrado" close the case.
Any solution guys?. Thanks!
trigger caseReOpen on Case (before update) {
for(Case c:trigger.new){
if(trigger.Oldmap.get(c.Id).Status=='Cerrado'){
c.Reaperturas__c ++;
}
}
}
Should work, weird. How's this?
trigger caseReOpen on Case (before update) {
for(Case c: trigger.new){
Case old = trigger.oldMap.get(c.Id);
if(c.Status == 'Asignado' && old.Status == 'Cerrado'){
++c.Reaperturas__c;
}
}
}
Compiled and saved ok? Can you put field history tracking on it, maybe you have something else that resets the counter? Are the actual picklist values like that or are these just labels? You need to use API values in Apex so if they're in English and you just have labels translated - your code won't work.
What if you base the check on !c.IsClosed && old.IsClosed ? It's a computed checkbox, can't be edited directly but it's bit more portable... If in future you add more statuses counting as closing (closed completed, closed cancelled etc?). https://developer.salesforce.com/docs/atlas.en-us.api.meta/api/sforce_api_objects_case.htm

I am thinking of easy account security Developers

If there is "FreezeToken" in the wallet, freeze the wallet.
And if there is "ThawToken" in the wallet, it cancels the freeze.
This code is an example of failure.
let FreezeToken = base58'GwmXnsF3Z5tANgHwmDW7Lf4SwyYNEp4S3QZM3aBFLHwS'
let ThawToken = base58'GK7ZV8xFbh1Qz14Cnr6mLkV93svaZGrurVuaBZocwLZZ'
match tx {
case m : ExchangeTransaction. =>
if (assetBalance(e.sender,ThawToken) >= 1 ) then{true}
else if (assetBalance(e.sender,ThawToken) >= 1 ) then{false}
else true
case _ => false
}
TransferTransaction succeeded but ExchangeTransaction failed.
How do I change this code? please tell me.
I am guessing you are creating a smart account?
From what I see in the code, is that you used 2 times ThawToken, one time this results to true and another time to false. My guess is that you want one from the 2 be replaced by FreezeToken
Also in your example you have "ExchangeTransaction.", this dot doesn't seem needed here from what I can understand from your code.
Also according to the examples it seems that your whole second if structure should be included into {}. Example: https://github.com/wavesplatform/ride-examples/blob/bc8db2342f53fe1554a10dc5aaa211b1542a5ca1/smart-assets/HotPotatoToken.ride#L41
However I think this issue could be solved with a && statement, and as following the second if-then-else is not needed anymore.
What I propose is a check that does following:
Check if ThawToken not in wallet and if that is the case, check if freezetoken is in wallet.
If ThawToken is and FreezeToken is also => wallet free since ThawToken frees it.
If ThawToken is not and FreezeToken is 1 or more => wallet locked since only FreezeToken.
If ThawToken is not and FreezeToken is not => wallet free since no FreezeToken
if (assetBalance(e.sender,ThawToken) == 0 &&
assetBalance(e.sender,FreezeToken) >= 1 ) then{
false
}else{
true
}
Also to block all transactions and indeed freeze the wallet, you would need to filter on another type, for all types use: Transaction, be careful this also disables the option to change the script in case you locked your account.
To block transfer transaction use: TransferTransaction.
All types can be found here:
https://docs.wavesplatform.com/en/smart-contracts/ride-language/standard-library.html

ag-Grid set filter and sort model without triggering event

I am updating sort & filter models via api:
this.gridApi.setFilterModel(filterModels);
this.gridApi.setSortModel(sortModels);
The problem with this is I have a server request bound to the change even of both sort & filter so when user changes then the data is updated. This means when I change model on code like restoring a state or resetting the filters it causes multiple requests.
Is there a way to update the filter/sort model without triggering the event?
I see there is a ColumnEventType parameter but couldn't see how it works. Can I specify some variable that I can look for inside my event handlers to get them to ignore calls that are not generated from user?
I am trying to manage URL state so when url query params change my code sets the models in the grids but this ends up causing the page to reload multiple times because the onFilter and onSort events get called when the model is set and there is no way I can conceive to prevent this.
At the time, you are going to have to manage this yourself, ie, just before you call the setModel, somehow flag this in a shared part of your app (maybe a global variable)
Then when you react to these events, check the estate of this, to guess where it came from.
Note that at the moment, we have added source to the column events, but they are not yet for the model events, we are planning to add them though, but we have no ETA
Hope this helps
I had to solve similar issue. I found solution which working for my kind of situation. Maybe this help someone.
for (let j = 0; j < orders.length; j++) {
const sortModelEntry = orders[j];
if (typeof sortModelEntry.property === 'string') {
const column: Column = this.gridColumnApi.getColumn(sortModelEntry.property);
if (column && ! column.getColDef().suppressSorting) {
column.setSort(sortModelEntry.direction.toLowerCase());
column.setSortedAt(j);
}
}
this.gridApi.refreshHeader();
Where orders is array of key-value object where key is name of column and value is sorting directive (asc/desc).
Set filter without refresh was complicated
for (let j = 0; j < filters.length; j++) {
const filterModelEntry = filters[j];
if (typeof filterModelEntry.property === 'string') {
const column: Column = this.gridColumnApi.getColumn(filterModelEntry.property);
if (column && ! column.getColDef().suppressFilter) {
const filter: any = this.gridApi.getFilterApi(filterModelEntry.property);
filter['filter'] = filterModelEntry.command;
filter['defaultFilter'] = filterModelEntry.command;
filter['eTypeSelector'].value = filterModelEntry.command;
filter['filterValue'] = filterModelEntry.value;
filter['filterText'] = filterModelEntry.value;
filter['eFilterTextField'].value = filterModelEntry.value;
column.setFilterActive(true);
}
}
}
Attributes in filter:
property - name of column
command - filter action (contains, equals, ...)
value - value used in filter
For anyone else looking for a solution to this issue in Nov 2020, tapping into onFilterModified() might help. This gets called before onFilterChanged() so setting a value here (eg. hasUserManuallyChangedTheFilters = false, etc.) and checking the same in the filter changed event is a possible workaround. Although, I haven't found anything similar for onSortChanged() event, one that gets called before the sorting is applied to the grid.
I am not sure any clean way to achieve this but I noticed that FilterChangedEvent has "afterFloatingFilter = false" only if filterModel was updated from ui.
my workaround is as below
onFilterChanged = event:FilterChangedEvent) => {
if(event.afterFloatingFilter === undefined) return;
console.log("SaveFilterModel")
}

Reverse display order in UITableView of Childs retrieved from Firebase Database [duplicate]

I'm trying to test out Firebase to allow users to post comments using push. I want to display the data I retrieve with the following;
fbl.child('sell').limit(20).on("value", function(fbdata) {
// handle data display here
}
The problem is the data is returned in order of oldest to newest - I want it in reversed order. Can Firebase do this?
Since this answer was written, Firebase has added a feature that allows ordering by any child or by value. So there are now four ways to order data: by key, by value, by priority, or by the value of any named child. See this blog post that introduces the new ordering capabilities.
The basic approaches remain the same though:
1. Add a child property with the inverted timestamp and then order on that.
2. Read the children in ascending order and then invert them on the client.
Firebase supports retrieving child nodes of a collection in two ways:
by name
by priority
What you're getting now is by name, which happens to be chronological. That's no coincidence btw: when you push an item into a collection, the name is generated to ensure the children are ordered in this way. To quote the Firebase documentation for push:
The unique name generated by push() is prefixed with a client-generated timestamp so that the resulting list will be chronologically-sorted.
The Firebase guide on ordered data has this to say on the topic:
How Data is Ordered
By default, children at a Firebase node are sorted lexicographically by name. Using push() can generate child names that naturally sort chronologically, but many applications require their data to be sorted in other ways. Firebase lets developers specify the ordering of items in a list by specifying a custom priority for each item.
The simplest way to get the behavior you want is to also specify an always-decreasing priority when you add the item:
var ref = new Firebase('https://your.firebaseio.com/sell');
var item = ref.push();
item.setWithPriority(yourObject, 0 - Date.now());
Update
You'll also have to retrieve the children differently:
fbl.child('sell').startAt().limitToLast(20).on('child_added', function(fbdata) {
console.log(fbdata.exportVal());
})
In my test using on('child_added' ensures that the last few children added are returned in reverse chronological order. Using on('value' on the other hand, returns them in the order of their name.
Be sure to read the section "Reading ordered data", which explains the usage of the child_* events to retrieve (ordered) children.
A bin to demonstrate this: http://jsbin.com/nonawe/3/watch?js,console
Since firebase 2.0.x you can use limitLast() to achieve that:
fbl.child('sell').orderByValue().limitLast(20).on("value", function(fbdataSnapshot) {
// fbdataSnapshot is returned in the ascending order
// you will still need to order these 20 items in
// in a descending order
}
Here's a link to the announcement: More querying capabilities in Firebase
To augment Frank's answer, it's also possible to grab the most recent records--even if you haven't bothered to order them using priorities--by simply using endAt().limit(x) like this demo:
var fb = new Firebase(URL);
// listen for all changes and update
fb.endAt().limit(100).on('value', update);
// print the output of our array
function update(snap) {
var list = [];
snap.forEach(function(ss) {
var data = ss.val();
data['.priority'] = ss.getPriority();
data['.name'] = ss.name();
list.unshift(data);
});
// print/process the results...
}
Note that this is quite performant even up to perhaps a thousand records (assuming the payloads are small). For more robust usages, Frank's answer is authoritative and much more scalable.
This brute force can also be optimized to work with bigger data or more records by doing things like monitoring child_added/child_removed/child_moved events in lieu of value, and using a debounce to apply DOM updates in bulk instead of individually.
DOM updates, naturally, are a stinker regardless of the approach, once you get into the hundreds of elements, so the debounce approach (or a React.js solution, which is essentially an uber debounce) is a great tool to have.
There is really no way but seems we have the recyclerview we can have this
query=mCommentsReference.orderByChild("date_added");
query.keepSynced(true);
// Initialize Views
mRecyclerView = (RecyclerView) view.findViewById(R.id.recyclerView);
mManager = new LinearLayoutManager(getContext());
// mManager.setReverseLayout(false);
mManager.setReverseLayout(true);
mManager.setStackFromEnd(true);
mRecyclerView.setHasFixedSize(true);
mRecyclerView.setLayoutManager(mManager);
I have a date variable (long) and wanted to keep the newest items on top of the list. So what I did was:
Add a new long field 'dateInverse'
Add a new method called 'getDateInverse', which just returns: Long.MAX_VALUE - date;
Create my query with: .orderByChild("dateInverse")
Presto! :p
You are searching limitTolast(Int x) .This will give you the last "x" higher elements of your database (they are in ascending order) but they are the "x" higher elements
if you got in your database {10,300,150,240,2,24,220}
this method:
myFirebaseRef.orderByChild("highScore").limitToLast(4)
will retrive you : {150,220,240,300}
In Android there is a way to actually reverse the data in an Arraylist of objects through the Adapter. In my case I could not use the LayoutManager to reverse the results in descending order since I was using a horizontal Recyclerview to display the data. Setting the following parameters to the recyclerview messed up my UI experience:
llManager.setReverseLayout(true);
llManager.setStackFromEnd(true);
The only working way I found around this was through the BindViewHolder method of the RecyclerView adapter:
#Override
public void onBindViewHolder(final RecyclerView.ViewHolder holder, int position) {
final SuperPost superPost = superList.get(getItemCount() - position - 1);
}
Hope this answer will help all the devs out there who are struggling with this issue in Firebase.
Firebase: How to display a thread of items in reverse order with a limit for each request and an indicator for a "load more" button.
This will get the last 10 items of the list
FBRef.child("childName")
.limitToLast(loadMoreLimit) // loadMoreLimit = 10 for example
This will get the last 10 items. Grab the id of the last record in the list and save for the load more functionality. Next, convert the collection of objects into and an array and do a list.reverse().
LOAD MORE Functionality: The next call will do two things, it will get the next sequence of list items based on the reference id from the first request and give you an indicator if you need to display the "load more" button.
this.FBRef
.child("childName")
.endAt(null, lastThreadId) // Get this from the previous step
.limitToLast(loadMoreLimit+2)
You will need to strip the first and last item of this object collection. The first item is the reference to get this list. The last item is an indicator for the show more button.
I have a bunch of other logic that will keep everything clean. You will need to add this code only for the load more functionality.
list = snapObjectAsArray; // The list is an array from snapObject
lastItemId = key; // get the first key of the list
if (list.length < loadMoreLimit+1) {
lastItemId = false;
}
if (list.length > loadMoreLimit+1) {
list.pop();
}
if (list.length > loadMoreLimit) {
list.shift();
}
// Return the list.reverse() and lastItemId
// If lastItemId is an ID, it will be used for the next reference and a flag to show the "load more" button.
}
I'm using ReactFire for easy Firebase integration.
Basically, it helps me storing the datas into the component state, as an array. Then, all I have to use is the reverse() function (read more)
Here is how I achieve this :
import React, { Component, PropTypes } from 'react';
import ReactMixin from 'react-mixin';
import ReactFireMixin from 'reactfire';
import Firebase from '../../../utils/firebaseUtils'; // Firebase.initializeApp(config);
#ReactMixin.decorate(ReactFireMixin)
export default class Add extends Component {
constructor(args) {
super(args);
this.state = {
articles: []
};
}
componentWillMount() {
let ref = Firebase.database().ref('articles').orderByChild('insertDate').limitToLast(10);
this.bindAsArray(ref, 'articles'); // bind retrieved data to this.state.articles
}
render() {
return (
<div>
{
this.state.articles.reverse().map(function(article) {
return <div>{article.title}</div>
})
}
</div>
);
}
}
There is a better way. You should order by negative server timestamp. How to get negative server timestamp even offline? There is an hidden field which helps. Related snippet from documentation:
var offsetRef = new Firebase("https://<YOUR-FIREBASE-APP>.firebaseio.com/.info/serverTimeOffset");
offsetRef.on("value", function(snap) {
var offset = snap.val();
var estimatedServerTimeMs = new Date().getTime() + offset;
});
To add to Dave Vávra's answer, I use a negative timestamp as my sort_key like so
Setting
const timestamp = new Date().getTime();
const data = {
name: 'John Doe',
city: 'New York',
sort_key: timestamp * -1 // Gets the negative value of the timestamp
}
Getting
const ref = firebase.database().ref('business-images').child(id);
const query = ref.orderByChild('sort_key');
return $firebaseArray(query); // AngularFire function
This fetches all objects from newest to oldest. You can also $indexOn the sortKey to make it run even faster
I had this problem too, I found a very simple solution to this that doesn't involved manipulating the data in anyway. If you are rending the result to the DOM, in a list of some sort. You can use flexbox and setup a class to reverse the elements in their container.
.reverse {
display: flex;
flex-direction: column-reverse;
}
myarray.reverse(); or this.myitems = items.map(item => item).reverse();
I did this by prepend.
query.orderByChild('sell').limitToLast(4).on("value", function(snapshot){
snapshot.forEach(function (childSnapshot) {
// PREPEND
});
});
Someone has pointed out that there are 2 ways to do this:
Manipulate the data client-side
Make a query that will order the data
The easiest way that I have found to do this is to use option 1, but through a LinkedList. I just append each of the objects to the front of the stack. It is flexible enough to still allow the list to be used in a ListView or RecyclerView. This way even though they come in order oldest to newest, you can still view, or retrieve, newest to oldest.
You can add a column named orderColumn where you save time as
Long refrenceTime = "large future time";
Long currentTime = "currentTime";
Long order = refrenceTime - currentTime;
now save Long order in column named orderColumn and when you retrieve data
as orderBy(orderColumn) you will get what you need.
just use reverse() on the array , suppose if you are storing the values to an array items[] then do a this.items.reverse()
ref.subscribe(snapshots => {
this.loading.dismiss();
this.items = [];
snapshots.forEach(snapshot => {
this.items.push(snapshot);
});
**this.items.reverse();**
},
For me it was limitToLast that worked. I also found out that limitLast is NOT a function:)
const query = messagesRef.orderBy('createdAt', 'asc').limitToLast(25);
The above is what worked for me.
PRINT in reverse order
Let's think outside the box... If your information will be printed directly into user's screen (without any content that needs to be modified in a consecutive order, like a sum or something), simply print from bottom to top.
So, instead of inserting each new block of content to the end of the print space (A += B), add that block to the beginning (A = B+A).
If you'll include the elements as a consecutive ordered list, the DOM can put the numbers for you if you insert each element as a List Item (<li>) inside an Ordered Lists (<ol>).
This way you save space from your database, avoiding unnecesary reversed data.

Meteor - alter data on publish

I am doing a card game in Meteor. Each played game is registered in the collection "Games".
A Games' record contain some of the game info as well as some players info and the cards hand of the players (players[i].cards, with values like 4S - 4 of spade, KH - king of heart...). Depending on the cards value, I can display the correct card to the frontend (div.card-KH).
Most of the game data is public but, of course, only the current player's cards must be visible.
One option could be to exclude the cards of the other players at publish time but I still need the number of cards to display the decks (only the remaining cards, hidden) of the other players.
Is there a way to replace the card value of each cards (except user's ones) in players[i].cards to, say, BACK (div.card-BACK) at publish time? Else, what would be the good design pattern to do this in Meteor?
Interesting question which I think there should be an official guideline to.
They have a bit in the docs about publishing:
http://docs.meteor.com/#/full/meteor_publish (secretinfo field only published to admins)
You could do the same but you would have to check the userId and have a player1secretinfo, player2secretinfo etc. (or perhaps a secretinfo array/object but then you would have to only publish one particular index/property)
You could also do a transform in the publications:
https://www.eventedmind.com/items/meteor-transforming-collection-documents
Please post it, if you find a good solution :)
Here is the only solution I found (I don't really like it but it works) :
Basically, you have to store a temporary document, with the same id but modified data, to another Collection, publish that document from that Collection and finally, from client side, subscribe to that publication.
Of course, never make hidden part of the original document available through another publication.
Meteor.publish('gameWithHiddenCards', function (gameId) {
var self = this;
//Transform function
var transform = function(item) {
for (var i=0; i<item.players.length; i++){
if ((item.players[i].id != self.userId))
for (var j = 0; j < item.players[i].cards.length; j++)
item.players[i].cards[j] = 'back';
return item;
};
/* 1. Observe changes in game ;
2. Apply transform function on game data ;
3. Store it to another Collection. */
var observer = Games.find({_id: gameId}).observe({
added: function (document) {
self.added('secure_games', document._id, transform(document));
},
changed: function (newDocument, oldDocument) {
self.changed('secure_games', newDocument._id, transform(newDocument));
},
removed: function (oldDocument) {
self.removed('secure_games', oldDocument._id);
}
});
self.onStop(function () {
observer.stop();
});
// Return altered game
return SecureGames.find({_id: gameId});
});