The very last thing we need to do is to head over to our Firebase dashboard and under the database tab,
remember that when we first set up our cloud Firestore, we set some rules that pretty much allowed anybody
to read and write into our database.
Now as Firebase warns you
it says that your security rules are pretty lax basically.
And if you click on learn more, it actually takes you to the documentation page on how to define cloud
Firestore
security rules. And you can look through this documentation to see what kind of level of security you
want for your documentation.
So for example you could have a database where nobody can read and write under any condition.
Well that's not going to be very useful for us.
And at the moment what we have is pretty much allowing anybody to write and read to our database which
is a bit too insecure.
So what we're going to choose is make sure that only authorized users or users who are logged in and
registered can actually access all our documents and read and write their messages to the database.
So to change it over, we're going to go ahead and copy all of this code and we're going to replace our
current lax rules with the new rules.
So we're going to select everything in here and delete it and then we're going to replace it with what
we copied over.
So this allows read and write access only if they have a user ID, namely they are already authenticated
and we can see them as one of our users.
And once you're ready, go ahead and click publish to make these rules go live and you'll see that our
warnings et cetera go away.
Now to test it, there's even a really handy simulator.
So for example you can say that I'm going to try and get some data out of my cloud Firestore. And we
can define a path to our documents under documents/messages. And we can check that if this request
is coming from somebody who's not authenticated trying to access our messages collection what happens.
And you can see that it tells us fails right? It doesn't let us read from our database and if we change
that to maybe say create, which is basically a write request, you can see it also gets blocked. Unless
we check the authenticated marker and we go ahead and add one of those e-mails that we'd already authenticated
and registered as one of our users,
and now if I click run, then you'll see that read is now allowed and so will write as well. So now that
our rules are live for our database then we don't have to worry about some randos accessing it.
And with that we've now completed our Flash chat app. So that's it.
That's all for the Flash chat app.
And I hope you had fun making this app and I hope you'll be building your own apps using Firebase cloud
Firestore and authentication.
There's so much more that you can explore. So take advantage of the documentation and what you learn
in this module.
I look forward to seeing all of your amazing creations on Twitter under the hashtag #FlutterBrew.