Firebase Realtime Database rules

Question

I am using the following rule to check that only 'admins' can write to the traps section.

"traps": {
    ".read": "auth != null",
    ".write": "auth != null  && root.child('admins').child(auth.uid).val() === true",
        },

This works fine. However if I change the rule to the following,

"traps": {
    "$trap" : {
      ".read": "auth != null",
      ".write": "auth != null  && root.child('admins').child(auth.uid).val() === true",
       }
    },

then I get a permission error. W/SyncTree: Listen at /traps failed: DatabaseError: Permission denied.

The reason I'm making this structure change is I'm trying to use the validate function but as I can't get past this first issue, I can't get as far as the validate.

"traps": {
    "$trap" : {
    ".read": "auth != null",
    ".write": "auth != null  && root.child('admins').child(auth.uid).val() === true",
      "trapNumber": {
         ".validate": "newData.isString()"
       }
    }
},

I'm sure this is a rookie comprehension error but I've made little progress with this after trying many permutations. You assistance would be greatly appreciated.

Update 20160629

Frank, the admin section looks as follows

admins
   somegeneratedkey: true

Can you add the following to your question: a snippet of the JSON (as text please) that you think should satisfy the root.child('admin') requirement, and the actual code for the write operation that fails. — Frank van Puffelen
I added the admin section above. I actually solved this problem though last night. Turns out I had a couple of problems. By movin the .read down to the $trap level it meant I was no longer authorized to read the Trap level individually — jimsis

jimsis jimsis · Accepted Answer · 2016-06-29T14:50:16

This worked for me

"rules": {
    "traps": {
    ".read": "auth != null",
    ".write": "auth != null  && root.child('admins').child(auth.uid).val() === true",
    "$trap" : {
            ".validate": "newData.hasChildren(['trapNumber']) && newData.child('trapNumber').isString()"
        }
    },
    etc.

I had to leave the read and write at the traps level as that was the level my database reference was using.

A little piece of additional information, isNumber() is not testing a String for a numeric value, it is testing that a numeric field (int) is passed. Not the behavior I was expecting.

Firebase Realtime Database rules

1 Answers