为何Firebase安全规则在数据库模拟器中无法限制@firebase/rules-unit-testing访问？

问题根源 #

测试失败的核心原因是测试环境未加载你配置的数据库规则，导致权限校验时没有应用".read": "false"的限制，未认证用户依然能读取数据，最终触发assertFails断言失败。

@firebase/rules-unit-testing库不会自动读取本地的database.rules.json文件，必须显式将规则加载到测试环境中，否则测试会使用默认规则（或模拟器临时的规则状态），而非你期望的拒绝所有读写的配置。

修复方案 #

你可以通过两种方式将规则加载到测试环境：

方式一：从本地规则文件加载

引入fs模块读取规则文件，在测试环境初始化后调用loadRules方法加载：

import {
  assertFails,
  initializeTestEnvironment,
  RulesTestEnvironment,
} from "@firebase/rules-unit-testing";
import { describe, beforeEach, it } from "mocha";
import { ref, get } from "firebase/database";
import fs from "fs";

describe("earth security rules tests", () => {
  let testEnv: RulesTestEnvironment;

  beforeEach(async () => {
    testEnv = await initializeTestEnvironment({
      projectId: "PROJECT_NAME",
      database: {
        host: "HOST",
        port: "PORT",
      },
    });
    // 加载本地database.rules.json文件中的规则
    await testEnv.loadRules({
      database: fs.readFileSync("./database.rules.json", "utf8"),
    });
  });

  it("should not allow read access to all users", async () => {
    const alice = testEnv.unauthenticatedContext();
    const db = alice.database("http://HOST:PORT/?ns=PROJECT_NAME");
    await assertFails(get(ref(db, "/users")));
  });
});

方式二：直接传入规则内容

在initializeTestEnvironment的配置中直接指定数据库规则：

import {
  assertFails,
  initializeTestEnvironment,
  RulesTestEnvironment,
} from "@firebase/rules-unit-testing";
import { describe, beforeEach, it } from "mocha";
import { ref, get } from "firebase/database";

describe("earth security rules tests", () => {
  let testEnv: RulesTestEnvironment;

  beforeEach(async () => {
    testEnv = await initializeTestEnvironment({
      projectId: "PROJECT_NAME",
      database: {
        host: "HOST",
        port: "PORT",
        // 直接传入规则配置
        rules: {
          ".write": "false",
          ".read": "false",
        },
      },
    });
  });

  it("should not allow read access to all users", async () => {
    const alice = testEnv.unauthenticatedContext();
    const db = alice.database("http://HOST:PORT/?ns=PROJECT_NAME");
    await assertFails(get(ref(db, "/users")));
  });
});

额外优化 #

你原代码中有一个未使用await的get请求，虽然不影响测试结果，但会导致控制台输出时机混乱，建议直接移除该代码块。

内容的提问来源于stack exchange，提问作者Yan Digilov