Accessing object property in Firebase Realtime Database ruleset

Question

I store data about trips in a Firebase Realtime Database. I have defined some user groups. I want only users from group "vips" to read trips that have freePlaces == 0 and all the others to read the remaining trips.

I tried to set such access rules:

{
  "rules": {
      "trips":{
          "$trip":{
            ".read": "root.child('users').child('vips').child(auth.uid).exists() || $trip.child('freePlaces') > 0"
           }
       }
   }
}

but Firebase tells me $trip has no method/property 'child'.

I tried to do it in a different way

{
  "rules": {
      "trips":{
          "$trip":{
            ".read": "root.child('users').child('vips').child(auth.uid).exists() || root.child('trips').child($trip).child('freePlaces') > 0"
           }
       }
   }
}

but Firebase says Invalid > expression: left operand must be a number or string.

What went wrong?

Frank van Puffelen Frank van Puffelen · Accepted Answer · 2021-01-14T16:12:52

I recommend playing close attention to the type of each expression in your rules:

$trip is a string, which explains why you can't call .child on it. If you want to get a child of the node, you can just do: data.child('freePlaces').
root.child('trips').child($trip).child('freePlaces') is a location in the database, which can't be compared with >. If you want the value of the node, use .val().

So combining these, your first snippet should be:

data.child('freePlaces').val() > 0

Accessing object property in Firebase Realtime Database ruleset

1 Answers