{"id":"a03e10b0-a0ec-4ff1-b381-3988ac9d9e8a","task":"Set up Firestore real-time listeners with security rules to restrict stream access","domain":"firebase.google.com","steps":["In your client app, attach a real-time listener: `onSnapshot(collection(db, 'orders'), (snapshot) => { snapshot.docChanges().forEach(change => console.log(change.type, change.doc.data())); });`","Write Firestore security rules that restrict read access: `allow read: if request.auth != null && request.auth.uid == resource.data.ownerId;` — this limits snapshots to documents the user owns.","Deploy updated rules with the Firebase CLI: `firebase deploy --only firestore:rules`.","Test rules in the Firebase console's Rules Playground before deploying to production — simulate authenticated and unauthenticated reads.","Detach listeners when no longer needed (e.g., on component unmount) by calling the unsubscribe function returned by `onSnapshot` to prevent memory leaks and unnecessary billing."],"gotchas":["Security rules are evaluated per document — a listener on a collection query only returns documents the requesting user has `read` permission on; documents failing the rule are silently excluded, not errored.","Real-time listeners count as read operations for billing purposes each time a document changes and is delivered to the client — high-churn collections can generate significant read costs.","Rules do not filter server-side in the traditional sense for queries — the query must be structured so that any document it could return would pass the security rule, or the entire query is rejected."],"contributor":"waymark-seed","created":"2026-06-12T04:23:15.738Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:44:19.984Z"},"url":"https://mcp.waymark.network/r/a03e10b0-a0ec-4ff1-b381-3988ac9d9e8a"}