How to implement user based security in the firebase database?

Question

This is the database for example:

"Messages" : {
      "Message1" : {
               "Uid" : "sampleid1"
                "Text" : "hi"
                },
       "Message2" : {
                "Uid" : "sampleid2"
                "Text" : " hello"
                }
  }

I want only those users to read the messages whose uid is equal to the Uid field of Message#.

The structure of database given in firebase documentation(i.e. using user id based messages in the database where the node of each message represents the uid of the user who sent the message) doesn't achieve the goal of my project as I need to know the uid of the user who sent the message each time any user sends a message.

Therefore, please suggest the rules that would help me achieve my task as mentioned in this question

Also, when I applied certain rules on the above structure of database, I couldn't read any data because 'firebase rules are not filters'.

Please ignore the syntax and format of json written in above example as it is just for reference

Please help!

Answer 1

Structure your data so:

"messages" : {
  "<receiver_uid>" : {
      "msg_1" : {
         "text" : "Hello world...",
         "uid" : "<sender_uid>"
      }
      // more msgs for this receiver ...
   }
}

the rules should be something like

{ 
  "rules" : {
    "messages" : {
      "$receiver" : {
        ".read" : "auth.uid == $receiver", // only receiver shall read
        ".write" : "auth != false" // any authenticated user can write
      }
    }
  }
}