Firebase Storage Rules strange behavior - firebase

Question

Based on the documentation, Firebase Storage Rules version 2 can be writen with granular operations.
A read operation can be broken into get and list. A write rule can be
broken into create, update, and delete.
service firebase.storage {
match /b/{bucket}/o {
// A read rule can be divided into read and list rules
match /images/{imageId} {
// Applies to single document read requests
allow get: if <condition>;
// Applies to list and listAll requests (Rules Version 2)
allow list: if <condition>;
// A write rule can be divided into create, update, and delete rules
match /images/{imageId} {
// Applies to writes to nonexistent files
allow create: if <condition>;
// Applies to writes to existing files
allow update: if <condition>;
// Applies to delete operations
allow delete: if <condition>;
}
}
}
}
Supose I have some rules like this:
rules_version = '2';
service firebase.storage {
match /b/{bucket}/o {
match /randomFiles {
allow get, create: if true;
allow list, update, delete: if false;
}
}
}
Based in the official documentation, with this rules I can:
Upload new files, if don't have any with the same id. (writes to nonexistent files)
Get a single document.
I can't update, delete or list any existing file.
These assuptions are right?
Because now, I have a strange behavior:
Using this rules, I can override existing files. This is a bug?
In my client if I upload a file and after that upload a new file using the same reference, the rules agree with that. Thus, override the first uploaded file.
The Minimum code to reproduces the aplication using Flutter 2.0 (stable channel) and firebase_storage 8.0.0
import 'dart:io';
import 'package:firebase_core/firebase_core.dart';
import 'package:firebase_storage/firebase_storage.dart';
import 'package:flutter/material.dart';
import 'package:flutter/widgets.dart';
const FILES_DIR = "filesDir";
void main() async {
//
WidgetsFlutterBinding.ensureInitialized();
await Firebase.initializeApp();
runApp(MyApp());
await uploadFiles();
}
Future<void> uploadFiles() async {
//
var firstfile = File('lib/someimage.png');
var secondFile = File('lib/otherImage.jpeg');
Reference dirRef = FirebaseStorage.instance.ref(FILES_DIR);
var firstTask = await dirRef.putFile(firstfile);
assert(firstTask.state == TaskState.success);
var secondTask = await dirRef.putFile(secondFile);
assert(secondTask.state == TaskState.success);
}
class MyApp extends StatelessWidget {
//
#override
Widget build(BuildContext context) {
return MaterialApp(
title: 'Flutter Demo',
home: Container(
child: const Center(child: Text("Minimum Flutter aplication for test purposes")),
),
);
}
}

Answer 1

The update permission only applies to updates to metadata. It's hinted at in the reference documentation here:
The write method covers all requests where file data or metadata is written, including file uploads, file deletes, and file metadata updates.
But that should definitely have been more explicit, so I filed a bug to get that updated.
You can implement your use-case already, but you'll do that through the create rule:
allow create: if resource == null
Let me know whether that works or not.