Firebase Rules for a social app

Question

I am trying to extend a social android aap, currently its rules are public, its data structure is something like this,

{
  "posts" : {
    "postId1" : {
      "authorId" : "abcd",
    },
    "postId2" : {
      "authorId" : "abcd",

    },
    "postId3" : {
      "authorId2" : "wxyz",

    },
    "postId4" : {
      "authorId2" : "wxyz",
    }
  }
}

I want to allow an authenticated user to create and delete his own post in "posts" node I tried this,

{
  "rules": {
        ".read":"auth.uid != null",
        ".write":false,
      "questions": {
      "$uid": {
        ".write": "$uid === auth.uid"
      }
    }
}}

But this does not allow a user to create a post although a user can edit or delete his pre-existing post in "posts" node, it seems that there is no write permission within the "posts" node. But if i allow write permission for "posts" then due to cascading rules, every authenticated user can access other's data. How can I achieve my desired functionality?

Umar Hussain Umar Hussain · Accepted Answer · 2018-04-29T11:37:43

First please see firebase-bolt for writing rules for real time database: https://github.com/firebase/bolt

This tool makes it easy to write rules.

And for your rules here is a sample which will allow only the author to update post:

{
  "rules": {
    ".read": "auth.uid != null",
    "posts": {
      "$postId": {
        ".write": "data.val() == null && newData.child('uid').val() == auth.uid || data.val() != null && newData.val() != null && data.child('uid').val() == auth.uid || data.val() != null && newData.val() == null && newData.child('uid').val() == auth.uid"
      },
      ".read": "auth.uid != null"
    }
  }
}

and the firebase bolt equivalent is below :

path / {
    read() {auth.uid != null}
}

path /posts {
    read() {auth.uid != null}
    /{postId}{
    create() { this.uid == auth.uid}
    delete() { this.uid == auth.uid}
    update() { prior(this.uid) == auth.uid}
    }
}

Firebase Rules for a social app

1 Answers