{
  "status": "Illustrative acceptance plan, not an executable test suite or observed production result",
  "topic": "Firestore security rules regression tests",
  "date": "2026-11-04",
  "sourceArticle": "https://aptixlabs.com/insights/firestore-security-rules-testing",
  "setup": [
    "Use synthetic accounts and records",
    "Record the environment and implementation version",
    "Agree the expected product contract before testing"
  ],
  "reviewSequence": [
    "Write an allowed-and-denied operation matrix",
    "Use synthetic identities and records in emulator tests",
    "Test immutable ownership and unexpected field changes"
  ],
  "cases": [
    {
      "id": "1",
      "condition": "A public user reads submitted enquiries",
      "expectedBehavior": "The request is denied",
      "observedBehavior": null,
      "status": "not_run"
    },
    {
      "id": "2",
      "condition": "A valid constrained submission is created",
      "expectedBehavior": "The intended create succeeds",
      "observedBehavior": null,
      "status": "not_run"
    },
    {
      "id": "3",
      "condition": "A caller changes an ownership field",
      "expectedBehavior": "The rule prevents unauthorized reassignment",
      "observedBehavior": null,
      "status": "not_run"
    }
  ],
  "tradeoff": "Excessively clever rules can become difficult to review. Prefer small explicit invariants and fixtures that explain the intended product behavior, then expand coverage when the contract changes."
}