金额可以减去 javascript firebase

Question

我创建了提款系统。我有一个错误。 示例：用户有 100 点。最小提款金额是 5。现在如果他多于他的金额加上（-）金额（提款 200，我只有 100，我的金额变为 -100）

我写了这段代码来阻止他，但这不起作用。任何帮助请截止日期是今天，我有几个错误:)

import { initializeApp } from "https://www.gstatic.com/firebasejs/9.5.0/firebase-app.js";
import {
  getFirestore,
  collection,
  onSnapshot,
  addDoc,
  deleteDoc,
  getDoc,
  setDoc,
  doc,
  query,
  where,
  orderBy,
  serverTimestamp,
  updateDoc,
  arrayUnion,
  arrayRemove,
} from "https://www.gstatic.com/firebasejs/9.5.0/firebase-firestore.js";

import {
  getAuth,
  signOut,
} from "https://www.gstatic.com/firebasejs/9.5.0/firebase-auth.js";

// For Firebase JS SDK v7.20.0 and later, measurementId is optional
const firebaseConfig = {
  apiKey: "Ow",
  authDomain: ".firebaseapp.com",
  projectId: "egyfaucet",
  storageBucket: ".appspot.com",
  messagingSenderId: "",
  appId: "1::web:"
};
// init firebase
initializeApp(firebaseConfig);
// const FieldValue = require('firebase-admin').firestore.FieldValue;

// init services
const db = getFirestore();
const auth = getAuth();
// const batch = db.batch();

// collection ref
const colRef = collection(db, "payments");
const colRefBound = collection(db, "bound");
const colRefUsers = collection(db, "users");

// Queires

const q = query(colRef, orderBy("createdAt"));


const requestBtn = document.querySelector("#added .big-input button");
const requestInput = document.querySelector("#added .big-input input");
// Validation
requestBtn.addEventListener("click", async function (){
    if(ValidationWallet(requestInput.value)){
        const { value: Amount } = await Swal.fire({
            icon:'question',
            title:'Amount',
            inputLabel: 'Select The Withdrawl Amount',
            showCancelButton: true,
            showCloseButton: true,
            cancelButtonColor: '#dc3545',
            confirmButtonText: 'Confirm',
            confirmButtonColor: '#0088FF',
            cancelButtonAriaLabel: 'Thumbs down',
            input:'text',
            preConfirm: () => this.Amount
        });
        if(ValidationAmount(Amount)){
            Swal.fire("Success","The Draw Is Waiting For Review","success");
            sendWithdrawlRequest(Amount) // This Function Bottom (DB)
        }else{
            Swal.fire("Ops!","Please Put The Valid Amount","error");
        }
    }else{
        Swal.fire("Ops!","Please Check Your Wallet","error");
    }

});
// Validation Function
function ValidationWallet(val) {
       if(
        val !== ""
        && val.length >= 10
        && true /* => Here Put Check In Wallet Adress API (DB) */
        ){
        return true
    }else{
        return false;
    }
}


function ValidationAmount(val) {
  auth.onAuthStateChanged((user) => {
      const userRef = doc(db, "users", user.uid);
      onSnapshot(userRef, (doc) => {
          console.log(doc.data().earningsCount);
          if (val >= doc.data().earningsCount) {
                return false;
              }
          })
        })

    if (val < 5) {
      return false;
    }
    if(val !== ""
       && val > 0
       && isNaN(val) == false
       && true /* => Here Put Check In Her Pont In (DB) >= amount*/
    ) {
        return true
    } else{
        return false;
    }

  }

// DB
function sendWithdrawlRequest(Amount){
    Amount = +Amount;

  auth.onAuthStateChanged((user) => {
    const paymentRef = doc(db, "payments", user.uid);
    const userRef = doc(db, "users", user.uid);
    let today = new Date();
    let date = today.getFullYear()+'-'+(today.getMonth()+1)+'-'+today.getDate();

    const requestCode = Math.random().toString(36).substr(2, 9);

  setDoc(doc(db, "payments", requestCode),{
    amount: Amount,
    walletID: requestInput.value,
    requestID: requestCode,
    createdAt: date,
});

    // add a pauments to the "user.payments" array field and (-) the amount in input.
    getDoc(userRef).then((doc) => {
    updateDoc(userRef, {
      earningsCount:
        doc.data().earningsCount - Amount,

      payments: arrayUnion({ amount: Amount, walletID: requestInput.value, createdAt: date,}),
    });
  });
  });


    // console.log(requestInput.value);
    // console.log(Amount); //Here Put Block Of Code To Senf Request
};


// push payment for user
const paymentsList = document.querySelector("#paymentsList");

// Real Time Collection data
onSnapshot(q, (snapshot) => {
  let payments = [];
  snapshot.docs.forEach((doc, i) => {
    payments.push({ ...doc.data() });
  });

  auth.onAuthStateChanged((user) => {
    if (user) {
      const userRef = doc(db, "users", user.uid);
      getDoc(userRef).then((doc) => {
        // console.log(doc.data().payments[0].amount);
        const pendingPayments = doc.data().payments;
        let html = "";
        pendingPayments.forEach((payment, i) => {
          // console.log(payment.count);
          // console.log(link);
          const div = `
          <tr>
              <td>${payment.amount}$</td>
              <td>${payment.createdAt}</td>
          </tr>
                `;
          html += div;
        });
        // Display payments from DB into Users UI
        paymentsList.innerHTML = html;
      });

    }
  });
});

Answer 1

如果您想防止earningsCount 变为负数，您可以在数据库的安全规则中这样做：

service cloud.firestore {
  match /databases/{database}/documents {
    match /users/{uid} {
      allow write: if 
        // Users can only write their own document
        request.auth != null && request.auth.uid == request.resource.data.author_uid
        // And their earningsCount can never become negative
        request.resource.data.earningsCount >= 0
    }
  }
}

只要访问数据，这些规则就会在服务器上自动执行，因此您的应用程序代码（或恶意用户可能使用您的配置数据运行的任何代码）无法绕过这些规则。

我强烈建议阅读 securing your database 上的 Firestore 文档以了解更多信息。