实时数据库规则问题

Question

Have a DB with a coaches path. Trying to secure with rules. So read below is only allowed if they auth matches they one the user signed in with. If I test this in the rules playground it passes.

 {
      "rules": {
        "Coaches": {
          ".indexOn": "coachEmail",
            "$uid":{
               ".read": "$uid==auth.uid",
            }

But in my app it does not work get the error in logcat Listen at /Coaches failed: DatabaseError: Permission denied What might the issue be? Could be an error in the code where the database gets queried?

//Query the database to get the current user
        Query query = databaseReference.orderByChild("coachEmail").equalTo(user.getEmail());
        query.addValueEventListener(new ValueEventListener() {

UPDATE:

 "rules": {
    "Coaches": {
      ".indexOn": "coachEmail",
        "$uid":{
           ".read": "auth.uid == $uid",
                    ".write": "auth.uid == $uid" 
        }

This passes in the rules playground

Type    read
Location    /Coaches/R6qhJIyLw9S6tI5llmuBhRvWWhn1
Data    null
Auth    { "provider": "anonymous", "uid": "R6qhJIyLw9S6tI5llmuBhRvWWhn1" }
Admin   false

Whenever I run my app I get the following error

Listen at /Coaches failed: DatabaseError: Permission denied

Not sure what the issue could be

Answer 1

Security rules do not filter your data in any way. They merely ensure that any operation your code performs against the database is allowed according to your rules.

Your code tries to load /Coaches , so the rules check if the user has read permission on /Coaches . Since they don't, the read operation is rejected.

The only read operation that is allowed by your current rules is:

databaseReference.child(user.getUid())...

---

Since you want to allow a query where the user specifies their own email address, you should update your rules to check for such a query too. As shown in the documentation on securely querying data , that'd be something like:

"Coaches": {
  ...
  ".read": "auth.uid != null &&
            query.orderByChild == 'coachEmail' &&
            query.equalTo == auth.token.email"
  ...
}