Firestore Review
Review Firestore for security rules, collection structure, composite indexes, listeners, offline persistence, and cost.
Key Checks
- Security rules: no open-access (allow read, write: if true is CRITICAL), auth checks, field validation
- Subcollection vs root collection decision based on access patterns
- Composite indexes for multi-field queries, collection group indexes for cross-parent queries
- Listeners detached on unmount, query-scoped (not full collection), error callbacks
- Offline persistence configured, cache size bounded, hasPendingWrites monitored
- Batch/transaction operations: batch.commit() for multiple writes, transactions for read-then-write
- Query limits: no multi-field inequality, max 10 values in in/array-contains-any
- Cost: select() for field masks, limit() on all lists, count() over full fetch
Output
Severity-sorted: CRITICAL, HIGH, MEDIUM, LOW, PASSED.
1---2name: firestore-review3description: Review Firestore security rules, collection structure, indexes, and queries for correctness and cost4---56# Firestore Review78Review Firestore for security rules, collection structure, composite indexes, listeners, offline persistence, and cost.910## Key Checks11- Security rules: no open-access (allow read, write: if true is CRITICAL), auth checks, field validation12- Subcollection vs root collection decision based on access patterns13- Composite indexes for multi-field queries, collection group indexes for cross-parent queries14- Listeners detached on unmount, query-scoped (not full collection), error callbacks15- Offline persistence configured, cache size bounded, hasPendingWrites monitored16- Batch/transaction operations: batch.commit() for multiple writes, transactions for read-then-write17- Query limits: no multi-field inequality, max 10 values in in/array-contains-any18- Cost: select() for field masks, limit() on all lists, count() over full fetch1920## Output21Severity-sorted: CRITICAL, HIGH, MEDIUM, LOW, PASSED.
ERP-CORE-DEV