CODEWITHSUNDEEP
firebasefirebase-security
jho
jho

Reputation: 1714

Firebase Security: read-only parent node, but writable child nodes

Can I have a read-only parent node, but allow write to its leaf node?

Use-case:

User parent Testimonial as children

I'd let authenticated user to read their own user object, but allow them write testimonials to other user.

Or shoud it be down as two parent level nodes with user id linked?

Thanks.

Upvotes: 2

Views: 641

Answers (1)

Mike Pugh
Mike Pugh

Reputation: 6787

Yes - you can.

Setup the more restrictive .write rule at the parent rule, but then setup a less restrictive .write rule at the leaf node.

For example:

{
   "root": {
       "parent": {
            "$user": {
                 ".write": false,
                 ".read": true,                    
                 "leaf": {
                     ".write": true
                 }
             }
       }
}

Upvotes: 2

Related Questions