Firebase 层次结构安全规则

Question

I have a problem restricting access to the children of the object

The rules I need:

roles - read
-- UID
--- SUPUSR
---- settings =  read only
--- store  = write and read

My rules

      "roles":{
     ".read":"auth != null",
     ".write":"root.child('roles/SUPUSR/').child(auth.uid).child('settings').child('pri_enabled').val() == 1 || root.child('roles/USERS/').child(auth.uid).child('settings').child('pri_enabled').val() == 1",
     "settings":{
        ".read":"auth != null",
        ".write":false
     }

If I leave it the way it is above, it inherits the "roles" rules for writing

Answer 1

Firebase Realtime Database Rules cascade , once you grant permission, you cannot revoke it . So if you allow write access on /roles , anyone can write to any child of /roles whether it's their own or someone else's data.

Other notes:

• The current rules affect /roles and /roles/settings , which is too high in the database tree, you should be setting the rules of /roles/SUPUSR/someUserId , /roles/SUPUSR/someUserId/settings and so on.
• The use of auth != null seems out of place. Should any logged in user be able to read any other user's roles? Should this only work for super users?
• Some of the data would also make sense to be validated .

{
  "rules": {
    "roles": {
      "SUPUSR": {
        "$uid": {
          // any data under /roles/SUPUSR/$uid is readable to logged in users
          ".read": "auth != null", 

          "nome": {
            // only this user can update nome, it also must be a string
            ".write": "auth.uid === $uid",
            ".validate": "newData.isString()"
          },
          "role": {
            // only this user can update role, and it must be one of a select number of string values
            ".write": "auth.uid === $uid",
            ".validate": "newData.isString() && newData.val().matches(/^(R&S|Admin|etc)$/)"
          },
          "store": {
            ".write": "root.child('roles/SUPUSR/').child(auth.uid).child('settings').child('pri_enabled').val() == 1 || root.child('roles/USERS/').child(auth.uid).child('settings').child('pri_enabled').val() == 1"
          }
          // any other keys are ".write": false, by default, which includes "settings"
        }
      }, // end /rules/roles/SUPUSR
      "USERS": {
        "$uid": {
          ...
        }
      }, // end /rules/roles/USERS
      ...
    }, // end /rules/roles
    ...
  }
}