CODEWITHSUNDEEP
firebasefirebase-realtime-databasefirebase-security
ronenmiller
ronenmiller

Reputation: 1137

Firebase - limit write to authorized user

I am writing an app where I have users, and each user has trips. I have managed to authenticate and insert user's data. Now I want to define rules for the trips list. Currently I can't get the simulator to work even with the same definitions (getting write/read permissions to users, but failing for trips, see pics): Failing for 'trips' passing for 'users' This is what I have that is failing:

{
  "rules": {    
    "users": {
      "$uid": {
        ".write": "$uid === auth.uid",
        ".read": "$uid === auth.uid"
      },
      "trips" : {
        "$uid" : {
            ".write": "$uid === auth.uid",
            ".read": "$uid === auth.uid"
        }
      }
    }
  }
}

What I actually want eventually is:

{
  "rules": {    
    "users": {
      "$uid": {
        ".write": "$uid === auth.uid",
        ".read": "$uid === auth.uid"
      },
      "trips" : {
        "$tid" : {
            ".indexOn": ["uid"],
            ".write": "<only if child field 'uid' is same as auth.uid>",
            ".read": "auth != null"
        }
      }
    }
  }
}

Upvotes: 1

Views: 268

Answers (1)

Ros&#225;rio P. Fernandes
Ros&#225;rio P. Fernandes

Reputation: 11326

That's because you've nested your "trips" rules under the "users" rules. They should both be under the "rules" node. Like this:

{
  "rules": {    
    "users": {
      "$uid": {
        ".write": "$uid === auth.uid",
        ".read": "$uid === auth.uid"
      }
    },
    "trips" : {
      "$tid" : {
          ".write": "$tid === auth.uid",
          ".read": "auth!=null",
          ".indexOn":"uid"
      }
    }
  }
}

Upvotes: 2

Related Questions