具有用户角色的FireBase安全规则

Question

First off, I've previously researched this and I have referenced a previous question. I have done what is stated in this question with no positive result.

Firebase: set security rules depending on user roles

I am using:

Angular JS
Firebase
AngularFire -- Integrate Firebase with AngularJS
E-mail and Password Firebase Authentication

I have a node in Firebase for my users:

"users" : {
  "simplelogin:49" : {
     "email" : "myemail@something.com",
     "full_name" : "First Last",
     "roles" : {
        "administrator" : true
     }
  },
  "simplelogin:64" : {
     "email" : "me@me.com",
     "full_name" : "first last",
     "roles" : {
       "administrator" : false
     }
   }
}

I am trying to add an entry in my clients table while being logged into the simplelogin:49 that as you can see is an administrator.

// Create the Client
                var clientRef = firebaseUrl+'clients';

                var clientsListRef = new Firebase(clientRef);
                clientsListRef.push({ 
                    'uid': userData.uid,
                    'number': cl.number,
                    'company': cl.company,
                    'full_name': cl.full_name,
                    'email': cl.email,
                    'phones': {
                        'primary': cl.phones.primary,
                        'cell': cl.phones.cell,
                        'alte': cl.phones.alte
                    },
                    'addresses': {
                        'billing': {
                            'line1': cl.addresses.billing.line1,
                            'line2': cl.addresses.billing.line2,
                            'city' : cl.addresses.billing.city,
                            'state': cl.addresses.billing.state,
                            'zip'  : cl.addresses.billing.zip
                        },
                        'shipping': {
                            'line1': cl.addresses.shipping.line1,
                            'line2': cl.addresses.shipping.line2,
                            'city' : cl.addresses.shipping.city,
                            'state': cl.addresses.shipping.state,
                            'zip'  : cl.addresses.shipping.zip
                        }
                    }

                });

I have set up some rules in Firebase for the clients node and they are as follows:

    "clients": {
       "$auth": {
          ".write": "root.child('users').child('$auth.uid').child('roles').child('administrator').val() === true"
        }
      }

I've also tried this for rules:

"clients": {
  ".write": "root.child('users').child('auth.uid').child('roles').child('administrator').val() === true"
}

All I get when I run this and it all gets put together is a permission denied error. If I run it in the Firebase Simulator, this is the result:

Attempt to write Success({"user":"Test"}) to /clients with auth=Success({"id":49,"provider":"password","uid":"simplelogin:49"})
/
/clients:.write: "root.child('users').child('auth.uid').child('roles').child('administrator').val() === true"
    => false

No .write rule allowed the operation.
Write was denied.

I would just like to know what I'm missing. The person in the question says he/she was successful in their ventures.

Answer 1

First things first, you should use the Firebase Authentication user id that is automatically generated for each user. You will have to look at the AngularFire documentation on how to access the authenticated user id, but usually its something along the lines of:

firebase.auth().currentUser().uid

Then, once you have created the user with that id as the name of the dictionary like so:

"users" : {
  "Rx6H4mjwwgVo6UKy2vSuOD5dTwk2" : {
     "email" : "myemail@something.com",
     "full_name" : "First Last",
     "roles" : {
        "administrator" : true
     }
  },
  "U1x3narB2AQQ0FvMxu7RVQAxb7A2" : {
     "email" : "me@me.com",
     "full_name" : "first last",
     "roles" : {
       "administrator" : false
     }
   }
}

you can use the auth.uid variable in the Firebase Database Security Rules to get their user id:

"rules" : {
  "clients": {
    ".write": "root.child('users').child(auth.uid).child('roles').child('administrator').val() == true"
  }
}