Firebase中的安全规则

Question

I've database structure like

 appointments
     [$userId]
         [$appointmentId]
              message:"something"
              date:"14/12/2015"
 users
    [$userId]
        name: Hardik
        email: hardikmsondagar@gmail.com

And I'm using angularfire library of Firebase, I'm trying to restrict read operation based on uid ( means a person who created appointment only can read that). I've tried following security rule

{
  "rules": {
    "appointments": {
      "$userId":{
        "$appointmentId":{
         ".read": "auth.uid==$userId",
         ".write": true
        }
      }
    },
    "users": {
      "$userId":
        {
          ".read": "auth!=null && $userId === auth.uid",
          ".write": "auth!=null && $userId === auth.uid"
        }
    }
  }

But end up on this error Error: permission_denied: Client doesn't have permission to access the desired data.

I'm trying to access all the user's appointments using following code

 var ref = new Firebase("https://<FIREBASE-APP>.firebaseio.com/appointments/"+uid);
 $scope.appointments = $firebaseArray(ref);

Answer 1

Set rules for the $uid wildcard, to read all the children.

"appointments": {
  "$uid":{
    ".read": "auth.uid == $uid",
    ".write": "auth.uid == $uid",
  }
}

The $uid wildcard sets permissions for the entire list, whereas the $appointmentId wildcard sets permissions for each individual item.

But Security Rules cascade, so you only need to set the rules for the top level.

Read the docs on cascading for more information.