Firestore rules keep changing

Question

I am using Firestore for my project and have updated my rules as such:

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /{document=**} {
        allow read, write: if request.auth != null;
          
    }
  }
}

Yet any time there is a change to the firestore it changes to something like this:

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /{document=**} {
      allow read, write: if
          request.time < timestamp.date(2020, 11, 26);
    }
  }
}

I have reset it multiple times over multiple days but it keeps changing back, what am I doing wrong?

Edit

Here is my package.json, it does not look like there is any reference to a rules file.

{
  "name": "functions",
  "description": "Cloud Functions for Firebase",
  "scripts": {
    "lint": "eslint .",
    "serve": "firebase emulators:start --only functions",
    "shell": "firebase functions:shell",
    "start": "npm run shell",
    "deploy": "firebase deploy --only functions",
    "logs": "firebase functions:log"
  },
  "engines": {
    "node": "12"
  },
  "main": "index.js",
  "dependencies": {
    "firebase-admin": "^9.2.0",
    "firebase-functions": "^3.11.0",
    "bad-words": "^3.0.3"
  },
  "devDependencies": {
    "eslint": "^5.12.0",
    "eslint-plugin-promise": "^4.0.1",
    "firebase-functions-test": "^0.2.0"
  },
  "private": true
}

Jadeite

Have you been deploying Cloud Functions through the Firebase CLI by any chance? – Depraved

No, I have been using the console to deploy these rules. Would that make a difference? – Jadeite

Nope. I was "hoping" the rules updates would come from the CLI, but if you didn't use the CLI that can't be it. – Depraved

hmm, well it seems to be staying, for now. I was just hoping to figure out why it was changing. I really wouldn't want it to change after I have published! – Jadeite

I checked with the engineering team, and they confirm: the only time our backend sets the rules automatically is during project/db creation (when you select the security model). I really wonder if somehow you're triggering the CLI, which then deploys an outdated rules config. – Depraved

Is there some way to check if I am? The only thing I use the CLI for is to deploy cloud functions, but I wouldn't think that would impact my firestore rules... – Jadeite

OK, that's what I asked in my first comment. My guess is that you're deploying a local, stale rules file when you deploy functions. Check your firebase.json for a reference to a Firestore rules file, and/or run firebase deploy --only functions. – Depraved

Oh man, sorry its been a long week I will check that. – Jadeite

Answer 1

My guess is that you're deploying a local, stale rules file when you deploy functions.

Check your firebase.json for a reference to a Firestore rules file, and/or run firebase deploy --only functions.

Depraved

I included my package.json, I can't find any reference to a rules file. – Jadeite

It does look like this was the issue, I tested deploying with and without the --only functions flag and it appears to have been changing my rules. – Jadeite

Answer 2

The previous answer was right in my case. You should look for files like: storage.rules for storage or firestore.rules for firestore. Every time you deploy new version of your system, Firebase overwrites your rules based on those files.

Mellicent