From acc9ec29e0adb61d3b7b62e68c566cacc56a4dcf Mon Sep 17 00:00:00 2001
From: ishowta <ishowta@gmail.com>
Date: Sat, 8 Aug 2026 14:30:36 +0900
Subject: [PATCH] Add firestore path validation examples

---
 .../references/enterprise/security_rules.md   | 27 +++++++++++++++++++
 .../references/standard/security_rules.md     | 27 +++++++++++++++++++
 2 files changed, 54 insertions(+)

diff --git a/skills/firebase-firestore/references/enterprise/security_rules.md b/skills/firebase-firestore/references/enterprise/security_rules.md
index 6f814e52..52099de9 100644
--- a/skills/firebase-firestore/references/enterprise/security_rules.md
+++ b/skills/firebase-firestore/references/enterprise/security_rules.md
@@ -409,6 +409,33 @@ within the context.
 allow create: if isScopedPath(request.resource.data.imageBucket) && ...
 ```
 
+When validating a field that contains a document ID that will be interpolated
+into a path, you **MUST** validate that it is a non-empty single path segment.
+
+**Example:**
+
+```javascript
+function isValidPostId(postId) {
+  return postId is string &&
+    postId.matches('^[^/]+$') &&
+    exists(/databases/$(database)/documents/posts/$(postId));
+}
+```
+
+When validating a field that contains a `DocumentReference`, you **MUST** check
+that it exactly matches the expected path.
+
+**Example:**
+
+```javascript
+function isValidPostReference(postRef) {
+  return postRef is path &&
+    postRef ==
+      /databases/$(database)/documents/posts/$(postRef[4]) &&
+    exists(postRef);
+}
+```
+
 #### 4. Secure Counter Updates
 
 When allowing users to update a counter (like `voteCount` or `answerCount`), you
diff --git a/skills/firebase-firestore/references/standard/security_rules.md b/skills/firebase-firestore/references/standard/security_rules.md
index 6f814e52..52099de9 100644
--- a/skills/firebase-firestore/references/standard/security_rules.md
+++ b/skills/firebase-firestore/references/standard/security_rules.md
@@ -409,6 +409,33 @@ within the context.
 allow create: if isScopedPath(request.resource.data.imageBucket) && ...
 ```
 
+When validating a field that contains a document ID that will be interpolated
+into a path, you **MUST** validate that it is a non-empty single path segment.
+
+**Example:**
+
+```javascript
+function isValidPostId(postId) {
+  return postId is string &&
+    postId.matches('^[^/]+$') &&
+    exists(/databases/$(database)/documents/posts/$(postId));
+}
+```
+
+When validating a field that contains a `DocumentReference`, you **MUST** check
+that it exactly matches the expected path.
+
+**Example:**
+
+```javascript
+function isValidPostReference(postRef) {
+  return postRef is path &&
+    postRef ==
+      /databases/$(database)/documents/posts/$(postRef[4]) &&
+    exists(postRef);
+}
+```
+
 #### 4. Secure Counter Updates
 
 When allowing users to update a counter (like `voteCount` or `answerCount`), you