Array elements for Firebase authentication rules

Question

Array elements for Firebase authentication rules

Currently, my app utilizes Firebase in conjunction with react native. Users are able to share content with different permissions - read, copy, or modify, and can do so with specific users or all users. Due to the fact that Firebase lacks an OR function for queries, I have resorted to using an array to store user:permission combinations. This enables me to utilize the array-contains-any capability for querying purposes as shown below:

.where("access", "array-contains-any", [user_id, `${user_id}:R`, `${user_id}:C`, `${user_id}:M`, "All_R", "All_C", "All_M"])

This method facilitates querying of content owned by a particular user, shared to that user, or shared with all users, while considering R, C, or M permissions.

My next objective is to implement a similar approach for authentication rules, ensuring that only users with "M" permission can perform modifications, etc. This will involve comparing the authenticated user ID to the user IDs stored in the array. Ideally, a feature akin to "array-contains-any" and string concatenation would be required for authentication rules.

Is this achievable within Firebase's capabilities, or should I explore alternative strategies?

javascript firebase google-cloud-firestore firebase-security

Answer 1

Answer №1

After conducting multiple tests, I have managed to make a subset of the available types function properly. Below, I will outline the steps taken so that you can further develop from this point.

The initial step involves making the following query operational:

ref.where("access", "array-contains", user_id)

This task can be easily secured with the following rule:

allow list: if request.auth != null && request.auth.uid in resource.data.access;

This essentially allows anyone to read the document if their UID is included in the access array.

The subsequent step requires permitting this query:

ref.where("access", "array-contains-any", [user_id, user_id+":R"]);

When attempting this with the previous set of rules, access is denied. This occurs because we are requesting a value that the rules do not recognize.

To rectify the situation, adjust the rules as follows:

allow list: if request.auth != null && (
  request.auth.uid in resource.data.access || 
  request.auth.uid+":R" in resource.data.access
);

Now, the conditions in both the code and the rules align once more, allowing the read operation.

If we introduce another condition for the all-access rules:

ref.where("access", "array-contains-any", [user_id, user_id+":R", "All_R"]);

Similar to before, our request is denied due to having a value in the query that is unrecognized by the rules.

To resolve this, incorporate that value into our rules as well:

allow list: if request.auth != null && (
  request.auth.uid in resource.data.access || 
  request.auth.uid+":R" in resource.data.access ||
  "All:R" in resource.data.access
);

With these adjustments, the query can now proceed successfully once again.

You can now include additional conditions here, and they should function accordingly.

Answer 2

After conducting multiple tests, I have managed to make a subset of the available types function properly. Below, I will outline the steps taken so that you can further develop from this point.

The initial step involves making the following query operational:

ref.where("access", "array-contains", user_id)

This task can be easily secured with the following rule:

allow list: if request.auth != null && request.auth.uid in resource.data.access;

This essentially allows anyone to read the document if their UID is included in the access array.

The subsequent step requires permitting this query:

ref.where("access", "array-contains-any", [user_id, user_id+":R"]);

When attempting this with the previous set of rules, access is denied. This occurs because we are requesting a value that the rules do not recognize.

To rectify the situation, adjust the rules as follows:

allow list: if request.auth != null && (
  request.auth.uid in resource.data.access || 
  request.auth.uid+":R" in resource.data.access
);

Now, the conditions in both the code and the rules align once more, allowing the read operation.

If we introduce another condition for the all-access rules:

ref.where("access", "array-contains-any", [user_id, user_id+":R", "All_R"]);

Similar to before, our request is denied due to having a value in the query that is unrecognized by the rules.

To resolve this, incorporate that value into our rules as well:

allow list: if request.auth != null && (
  request.auth.uid in resource.data.access || 
  request.auth.uid+":R" in resource.data.access ||
  "All:R" in resource.data.access
);

With these adjustments, the query can now proceed successfully once again.

You can now include additional conditions here, and they should function accordingly.

Array elements for Firebase authentication rules

Answer №1

Similar questions

Issue: The component factory for GoogleCardLayout2 cannot be located

Following a successful ajax response, the functionality of the JavaScript ceases to operate

Combine Laravel with Vue.js to dynamically load additional data by simply clicking on a button

Limiting the number of characters in a textarea using React with TypeScript

Put identical objects into several arrays at the same time

The error message [jsonFlickrApi is not defined] in JavaScript is indicating that the

"Utilize ajax and a modal window to insert a new record

Determine whether an item in a RadGrid is currently in Edit mode using Javascript

Can I safely keep a JWT in localStorage while using ReactJS?

Using jQuery to create dynamic elements that fade out with timers

The process of JavaScript for detecting and extracting text from

Incorporating a div element dynamically into a cell within a datatable with JavaScript

What is the reason behind the Placeholder not functioning in IE8?

Flames dancing - transmitting parameter through callback feature

How can I retrieve the SID received in a different tab using MSAL.js?

Is there a way to remove the sign up link from the AWS Amplify Vue authenticator?

Sorting and dividing an Array using Angular

Tips for incorporating the camera from fbxloader into your three.js scene

Taking out the modal element from the document object model, causing the animation

The URI entered is not valid: The parsing of the hostname failed. Electron Builder