Firebase Security rules for a nested data structure

Question

I'm working on a Firebase rule configuration to control read/write access to my database. I had more rules written originally, but I've pared things down during troubleshooting. Here is my current rule configuration:

{
  "rules": {
   "developers": {
      "$dev": {
        ".write": "!data.exists() && auth != null",
        ".read": "auth.devBucket === $dev",
        "$proj": {
          ".read": "auth.devBucket === $proj",
          "shared": {
            ".write": "!data.exists() || (auth.devBucket === $dev && auth.projBucket === $proj)"
          }
        }
      }
    }
  }
}

What I'm trying to do is allow users of the Firebase to create a $dev node, $proj node, and shared node as long as they don't already exist and the user is authenticated. Then, I want to allow a user to have free write access within the shared node as long as their auth token's devBucket matches the $dev node they're writing within and their auth token's projBucket matches the $proj node they're writing within. I'm using the Firebase custom auth system for Android and I've loaded my tokens with these devBucket and projBucket variables. Authentication is definitely working according the my logcat, but I'm definitely getting permission denied errors with my current rules. I've been pouring over the Firebase Rule documentation and questions here for days and I am still puzzled as to the nuances of how their rule system works.

According to the documentation rules carry through to lower levels of nesting in the JSON, I'm just having trouble understanding how I can write a rules that allows a node and it's children to be created once, but also allows any number of children to be written or overwritten under shared if you're properly authenticated.

Does anyone have any idea how I could write rules to accomplish what I'm trying to do?

EDIT: I think it's also worth mentioning that I'm getting permission denied errors when I try to point listeners to my nodes too.

Will Byrne Will Byrne · Accepted Answer · 2015-07-26T06:34:56

I figured out a configuration that worked for me.

{
   "rules": {
       "developers": {
         ".write": "!data.exists() || auth != null",
         ".read": "auth != null",
          "$dev": {
            ".write": "!data.exists() || (auth != null && auth.devBucket == $dev)",
            ".read": "auth != null && auth.devBucket == $dev",
            "$proj": {
              ".write": "!data.exists() || (auth != null && auth.projBucket == $proj)",
              ".read": "auth != null && auth.projBucket == $proj"
            }
          }
        }
    }
}

Firebase Security rules for a nested data structure

1 Answers