CODEWITHSUNDEEP
node.jsfirebase-realtime-databasefirebase-authenticationfirebase-security
kwankwan
kwankwan

Reputation: 1

Custom claim for multiple realtime databases in Firebase

I've tried to set custom claims for Admin users so they can access and change the data in 9 real-time databases (custom claim: "admin": true).

The security rules for those 9 are the same, a user with the "admin" role can write and change the data for "admin_controller" in the database. But when I used an admin account, I could only change the data for database 1 and couldn't change database 2, 3, 4, etc. data (permission denied)

Here's my code and my security rules:

Backend code:

var admin = require("firebase-admin");

var app_firebase = admin.initializeApp({
  credential: admin.credential.applicationDefault()
});

app.get('/setAdmin/:user_id', (req, res) => {
  var user_id = req.params.user_id;
  const additionalClaims = {
    admin: true,
  };
  admin.auth().setCustomUserClaims(user_id, additionalClaims)
  res.status(200).json({ message: 'successful' })
});

Security rules:

"rules": {
    ".read": true,
    "admin_controller": {
        ".write": "auth.uid !== null && auth.token.admin === true"
    },
}

Thank you.

Upvotes: 0

Views: 37

Answers (1)

Frank van Puffelen
Frank van Puffelen

Reputation: 598623

Each Realtime Database instance in a Firebase project has its own set of security rules, so be sure to update the rules for all of your instances as shown in the documentation on deploying the security rules for each instance.

Upvotes: 1

Related Questions