firebase deploy --only firestore in a project shared with another app overwrites the (default) database's security rules

TL;DR

If a project's (default) Firestore database belongs to another app, a plain firebase.json firestore block (no database key) deploys your rules to (default) and replaces that app's live rules. Create a separate named database for the new app, pin it with "database" in firebase.json, and open it with getFirestore(app, "<id>") in the Admin SDK.

Context (this deployment)

Arani was deployed into an existing Firebase project whose (default) database, data and security rules belong to another web app. Arani's rules are deny-all (only the server's Admin SDK touches data). Deploying them to (default) would have swapped the other app's rules for deny-all and blocked its client-side reads and writes.

Cause (documented)

• firebase init writes a single firestore key "corresponding to your project's default database". Firebase CLI docs, Configuration for multiple Cloud Firestore databases: https://firebase.google.com/docs/cli#firestore-multiple-dbs
• "When you deploy security rules using the Firebase CLI, the rules defined in your project directory overwrite any existing rules in the Firebase console." https://firebase.google.com/docs/rules/manage-deploy
• "By default, the Firebase SDKs and Google API Client Libraries connect to the (default) Cloud Firestore database in a project." https://firebase.google.com/docs/firestore/manage-databases

Fix

1. Create a dedicated database (Native mode):

gcloud firestore databases create --database=arani --location=europe-west4 --type=firestore-native

2. Pin rules and indexes to that database in firebase.json:

{
  "firestore": {
    "database": "arani",
    "location": "europe-west4",
    "rules": "firestore.rules",
    "indexes": "firestore.indexes.json"
  }
}

database and location are both properties of FirestoreSingle in the firebase-tools config schema (https://github.com/firebase/firebase-tools/blob/master/schema/firebase-config.json). The CLI docs show database in the array form, one entry per database, if you need rules for several databases. 3. Point the server at the same database (firebase-admin/firestore):

import { initializeApp } from 'firebase-admin/app';
import { getFirestore } from 'firebase-admin/firestore';

const app = initializeApp();
const db = getFirestore(app, 'arani'); // getFirestore(app) would open (default)

getFirestore(app, databaseId) "Gets the named Firestore service for the given app". The Admin SDK reference marks it Public Preview: https://firebase.google.com/docs/reference/admin/node/firebase-admin.firestore.md 4. Deploy: firebase deploy --only firestore:rules,firestore:indexes --project PROJECT_ID. Per the docs, firestore:rules deploys rules "for all databases configured in your firebase.json", so here only arani.

Verify

• Rules releases are named projects/PROJECT_ID/releases/cloud.firestore for (default) and .../cloud.firestore/<databaseId> for named databases (see the REST section of https://firebase.google.com/docs/rules/manage-deploy). List them with the Firebase Rules API (projects.releases.list). A deploy must not change the updateTime of the (default) release cloud.firestore. Only cloud.firestore/arani may change.
• In the Firebase console, the (default) database's Rules tab should show no new version.