Go to Firebase Console → Firestore Database → Rules and paste:
rules_version = '2';
service cloud.firestore {
match /databases/{database}/documents {
function isAdmin() {
return request.auth != null
&& request.auth.uid == 'YOUR_ADMIN_UID';
}
match /products/{id} {
allow read: if true;
allow create, delete: if isAdmin();
allow update: if isAdmin()
|| (request.auth != null
&& request.resource.data.diff(resource.data)
.affectedKeys().hasOnly(['clicks','clicks30d','lastClickAt']));
}
match /categories/{id} { allow read: if true; allow write: if isAdmin(); }
match /stores/{id} { allow read: if true; allow write: if isAdmin(); }
match /settings/{id} { allow read: if true; allow write: if isAdmin(); }
}
}
Get your Admin UID: Firebase Console → Authentication → Users → copy your UID
| Image | Name ↕ | Store | Categories | Status | Clicks ↕ | Added ↕ | Actions | |
|---|---|---|---|---|---|---|---|---|
Create Category
Tip: paste an emoji in the icon field (e.g. 👕 👟 ⌚)
Add Store
Tip: paste an emoji in the icon field
Social Links
Contact & Site Info
Search Index
Products need a searchTokens field to be found by public search across the full catalogue. New/edited products get this automatically. Use this to backfill it onto older products that predate this feature.
Category Schema Migration
One-time, admin-only. Normalizes every product onto a single field, categoryIds (array) — folding in the legacy categoryId value, removing duplicates and empty entries — then deletes the legacy categoryId field once its value is safely included. Nothing else on the product is changed — draft/published status included. Idempotent: products already normalized are skipped and nothing is written for them, so it's safe to run more than once or retry after a partial failure. Run this before relying on category-only filtering everywhere, and re-run Reindex All Products for Search above afterward if any category names changed as a result.
Security Checklist
The admin check in this page (user.uid === ADMIN_UID) and the rules shown elsewhere in this app describe the intended access model, but this static HTML/JS has no way to confirm what's actually enforced server-side. Verify these directly in Firebase Console → Firestore Database → Rules before trusting this app's security:
- The deployed rules match what this app expects — reads public, writes admin-UID-only.
- Public write access to products is scoped to only
clicks,clicks30d,lastClickAt— nothing else. ADMIN_UIDin this file is your actual Firebase Auth UID, not a placeholder.- No other rule (e.g. a leftover "allow write: if true" from testing) is still deployed.
Live Preview