W / SyncTree：在/ Products上侦听失败：DatabaseError：权限被拒绝？

Question

I am developing a rudimentary delivery app using android studio and I am using Firebase as the database. I need to save the user info and also products that all the users can select from. So basically each user has access to only their details but each user can access details from all the Products. Here are my rules for the database:

    {
"rules": {
"users": {
  "$uid": {
    ".read": "auth != null",
    ".write": "auth != null"
      }
  },"Products": {
"$uid": {
    ".read": true,
    ".write": true
  }
 }
}
}

And the database structure:

    pat-2017-42536
     Products
       1
         Description: "Product description"
         Name: "Name of product"
         Price: "Price of product"
       2
         Description: "Product description"
         Name: "Name of product"
         Price: "Price of product"
       etc...

I tried changing the permissions to true as some previous questions suggested but it still keeps giving me this error:

     W/SyncTree: Listen at /Products failed: DatabaseError: Permission denied

This is in my onCreate in Andoid Studio:

    databaseProducts = FirebaseDatabase.getInstance().getReference("Products");
    databaseProducts.addValueEventListener(new ValueEventListener() {
        @Override
        public void onDataChange(DataSnapshot dataSnapshot) {
            showData(dataSnapshot);
        }
        @Override
        public void onCancelled(DatabaseError databaseError) {

        }
    });

Here is the method that is supposed to fetch the product details:

    private void showData(DataSnapshot dataSnapshot) {
    for(DataSnapshot productSnapShot: dataSnapshot.getChildren()){

        Product product = productSnapShot.getValue(Product.class);
        product.setName(productSnapShot.child("item").getValue(Product.class).getName());
        product.setDescription(productSnapShot.child("item").getValue(Product.class).getDescription());
        product.setPrice(productSnapShot.child("item").getValue(Product.class).getPrice());

        ArrayList<String> array = new ArrayList<>();
        array.add(product.getName());
        array.add(product.getDescription());
        array.add("R" + product.getPrice() + ".00");

        Log.d(TAG,"showData: name " + product.getName());
        Log.d(TAG,"showData: description " + product.getDescription());
        Log.d(TAG,"showData: price " + product.getPrice());

        ArrayAdapter adapter = new ArrayAdapter(CustomerActivity.this,android.R.layout.simple_expandable_list_item_1,array);
        listViewProducts.setAdapter(adapter);

    }
}

It is probably a simple error but I can't seem to find it. Any help?

Answer 1

The problem is that you try to read at /Products while you allow read at /Products/Something . Enable read at Products node.

Your rules should be something like

{
    "rules": {
                   "users": {
                                    "$uid": {
                                                 ".read": "auth != null",
                                                 ".write": "auth != null"
                                   }
                    },
                   "Products": {
                                         ".read": true,
                                         ".write": true
                  }
       }
}

Answer 2

I don't think the above answer Birendra provided will do what you want it to. I believe that that will allow any authenticated user to read and write in any other specific users id. This is the same as the default rules, but just specific to the users id. He is right about the fact that you have it set up so that it is looking for /Products/$uid and so if you want anyone at all (whether authenticated or not) to both read and write to your products list then that would be the rules--but I can't imagine that you want your products list to be modifiable by everyone . From what I understand you want users to be able to read and write their own account info, but everybody can access the products. I'm not sure if you only want authenticated users to be able to view the products or not, so I'll include the rules for both. Remember, your read and write rules do NOT have to be the same for a particular node. So if you wanted to have every authenticated user be able to see the information of other users but only that particular user can write to their own profile, and if you want your "products" to be viewable by the general public (authentication not required), but you obviously don't want the public messing with your products you could have rules like this:

{
    "rules": {
                   "users": {
                              ".read": "auth != null", //all authenticated users can read the information from the "users" node.
                                    "$uid": {
                                             ".write": "$uid === auth.uid" //only a user with an authenticated uid that matches the uid of the child node will be able to write to their node--no need for a read rules because it is already covered in the parent node
                                   }
                    },
                   "Products": {
                                         ".read": true,
                                         ".write": false //you don't want just anybody to write to this node--probably even better since this wouldn't allow anyone to modify the products is to set it up with an admin access where a specific uid is the only one that has access--such as ".write": "auth.uid === 'dJrGShfgfd2'"
                  }
       }
}

If you want only authenticated users to be able read the products, but not modify the products, then you would want:

{
    "rules": {
                   "users": {
                              ".read": "auth != null",
                                    "$uid": {
                                             ".write": "$uid === auth.uid"
                                   }
                    },
                   "Products": {
                                         ".read": "auth != null",
                                         ".write": false
                  }
       }
}

Finally, if authenticated users can add or modify products, then you would want:

{
    "rules": {
                   "users": {
                              ".read": "auth != null",
                                    "$uid": {
                                             ".write": "$uid === auth.uid"
                                   }
                    },
                   "Products": {
                                         ".read": "auth != null",
                                         ".write": "auth != null"
                  }
       }
}

Answer 3

Make the rules to be as shown below Make sure that you have chosen REALTIMEDATABASE.

 {
 security rules. */
  "rules": {
    ".read": true,
    ".write": true
  }
}

There will be two DATA bases 1) cloud firestore 2) Real Time data Base Choose the real time database and change the rules as the above mentioned one.

The above rule makes it visible to all the people.