Crate hidane_rules 

Firestore Security Rules as hidane implements them: the lexer, the parser and the checks of the official emulator’s compiler (PUT :securityRules), with its diagnostics.

compile takes the files of a ruleset and returns the Ruleset (if it compiled) and the Issues: warnings for a ruleset that compiles, warnings and errors for one that does not, in the official emulator’s words and positions. eval::authorize decides a request against a ruleset.

What the official emulator does, as measured with tools/oracle/rules_compile.py (crates/hidane/tests/fixtures/rules_compile.json):

• Every file is parsed and its paths checked. Only the first file is checked further and becomes the ruleset; the others only add their errors.
• A syntax error stops there: the message lists the syntax errors and the grammar’s own (Missing 'if' before conditional expression.). Otherwise the version, imports and match paths are checked (an unsupported version stops), then namespaces used as variables and expressions nested too deep, and, if nothing was an error, the names, functions and types.
• Issues are ordered by line, column and text; one about the whole ruleset (the old version warning) has no position and comes first.

Modules

coverage

The coverage report of GET /emulator/v1/projects/{p}:ruleCoverage: what each expression of a ruleset evaluated to, as the official emulator reports it (tools/oracle/rules_coverage.py, crates/hidane/tests/fixtures/rules_coverage.json).

eval

Evaluating a ruleset for one request: what the evaluator takes and what it decides.

paths

Which match statements cover a path, and what their wildcards hold (#59).

Structs

Allow

allow read, write: if condition;.

Body

What a service or a match contains, each kind in source order.

Compilation

What compile found.

Expr

Function

function name(params) { let x = …; return expr; }.

Ident

Issue

Let

Match

match /path/{var}/{rest=**} { … }.

MethodName

Position

Where an issue is, as the official emulator reports it: line and column are 1-based, the offsets count code points from the start of the file, and end_offset is the last code point of the span (inclusive).

Ruleset

Segment

Service

SourceFile

A file of a ruleset, as PUT :securityRules sends it.

Span

Where a node is: byte offsets into its file (end exclusive) and the line and column (1-based, in code points) of its start, as the official emulator prints them (evaluation error at L5:22).

Enums

BinaryOp

Callee

ExprKind

Method

PathPart

SegmentKind

Severity

UnaryOp

Version

rules_version: '1' (or none) and '2' differ in how recursive wildcards match.

Functions

compile

Compiles the files of a ruleset. Without files there is nothing to compile: the result is an error about empty content.