CODEWITHSUNDEEP
firebasefirebase-realtime-databasefirebase-security
Fireprufe15
Fireprufe15

Reputation: 249

Firebase rules to give read permission based on other related data not working

So I'm making a calendar app using Firebase, and I've come across a little snag.

My DB structure is like this:

- calendar
  - $year
    - $month
      - $day
        - $uid
          - name
          - arrivalStatus
- users
  - $uid
    - name
    - team

So what I want to do is that people on the same team must be able to read each other's entries in the calendar. I've set the rules up like this:

{
 "rules": {
   "users": {
      "$uid": {
        ".read": "auth != null && auth.uid == $uid",
        ".write": "auth != null && auth.uid == $uid"
      }
   },
   "calendar": {
    "$year":{
     "$month":{
       "$day":{
        "$uid":{
          ".read": "auth != null && 
                    root.child('users/'+auth.uid+'/team').exists() && 
                    root.child('users/'+$uid+'/team').val() == root.child('users/'+auth.uid+'/team').val()",
          ".write": "auth != null && auth.uid == $uid"
          }
        }
      }
    }
  }
 }
}

But for whatever reason, when running it through the simulation, the request is approved no matter what team you are on. Am I missing something obvious?

EDIT:

So basically let's assume this dataset:

-firecalender
 -calendar
  -2016
   -9
    -30
     -gsdfgd
      -Name: "MG"
      -Status:"PM"
-users
  -abcd
    -name: "Tester"
    -team: "bc"
  -efg
    -name: "noteam"
    -team: "funny inc"
  -gsdfgd
    -name: "bossman"
    -team : "bc"

In this situation, abcd should be able to read each gsdfgd's info inside Calendar, but efg should be denied access.

Upvotes: 4

Views: 275

Answers (1)

Sebastian Alin Penea
Sebastian Alin Penea

Reputation: 21

I think your problem is that you are using == instead of ===.

Link for examples: https://firebase.google.com/docs/database/security/user-security

Upvotes: 2

Related Questions