Firebase Object Ownership with Event Observation

Question

I'm using Firebase in my iOS app. I'd like each of my objects to have a creatorId property whose value is the authenticated user ID (authData.uid with a Firebase authentication object). I'm using a custom token generator for authentication, but the problem can be reproduced with anonymous log in too.

I'd like a user to only be able to read (and write, but let's focus on reading right now, as that's where I'm having my issues) objects that they created. In other words, the querying user's authenticated user ID will match the creatorId of the objects they are fetching.

I'm having trouble with permissions when I craft queries and rules to make this happen.

Here is the Firebase documentation for Rules and Security.

Here is what my Firebase dashboard looks like for a Task object:

+ firebase-base
    + tasks
        + {task_id}
             + creatorId: 
             + title: 

where task_id is a unique identifier generated by Firebase upon insertion.

My rules look like this (again, let's ignore writing rules for now):

{
   "rules": {
       "tasks": {
         "$task_id": {
           ".read": "auth.uid === data.child('creatorId').val()"          
         }
       }
   }
}

Reading a specific task works fine, but I'd expect to be able to make a query that says, "fetch all the tasks that I created" using observeEventType and related functions. This doesn't work for me. I get "Permission Denied" errors.

Here is how I'm observing, in Swift:

let reference = Firebase(url: "https://{My-Firebase-Base-Reference}/tasks")
reference.observeEventType(.ChildChanged, 
     withBlock: { (snapshot: FDataSnapshot!) -> Void in

                       // Success

             }) { (error: NSError!) in

                       // Error: I get Permissions Denied here.

              }

Per @Ymmanuel's suggestions, I also tried being more specific in my query, like so:

let reference = Firebase(url: "https://{My-Firebase-Base-Reference}/tasks")
reference.queryOrderedByChild("creatorId").queryEqualTo({USER_UID}).observeEventType(.ChildChanged, 
     withBlock: { (snapshot: FDataSnapshot!) -> Void in

                       // Success

             }) { (error: NSError!) in

                       // Error: I get Permissions Denied here.

              }

Neither of these blocks work, I always get "Permission Denied" errors. What am I doing wrong?

Answer 1

What you are missing is that you are assuming that security rules are queries and that is not true.

Check the Rules are Not Filters section in the link.

Security rules only validate if you can read or write a specific path of your firebase database.

If you want to only receive changes of a specific user you should use firebase queries.

For example if you want to get all the tasks of a specific user, you should do:

let reference = Firebase(url: "https://{My-Firebase-Base-Reference}/tasks")
reference.queryOrderedByChild("creatorId").queryEqualTo(YOUR_CURRENT_USER_UID).observeEventType(.ChildChanged, 
     withBlock: { (snapshot: FDataSnapshot!) -> Void in
          // Success
     }) { (error: NSError!) in
          // Error: Get Permissions Denied Here.
}

This way you could get all the events only related to your user, and protect the information by applying the security rules.

also if you want to allow only the creator to write their own tasks you should also consider the case where you create the task and write something like this:

  "tasks": {
     //You need to include the $task_id otherwise the rule will seek the creatorId child inside task and not inside your auto-generated task
     "$task_id": {
       ".read": "auth.uid === data.child('creatorId').val()",
       //this is to validate that if you are creating a task it must have your own uid in the creatorId field and that you can only edit tasks that are yours...
       ".write":"(newData.child('creatorId').val() === auth.uid && !data.exists()) || (data.child('creatorId').val() === auth.uid && data.exists())",
       //you should add the index on to tell firebase this is  a query index so your queries can be efficient even with larger amounts of children
       ".indexOn":"creatorId",        
     }
   }

(check the syntax but that's the general idea)

Answer 2

A couple of comments:

If local persistence is on, and you have no internet connection and there is no local value, neither of the blocks will be called.

The observe code in the question is bugging me, it's not wrong but may be a bit clearer if it was like this:

    reference.observeEventType(.ChildChanged, withBlock: { snapshot in

            print(snapshot.value)

        }, withCancelBlock: { error in

            print(error.description)

    })

Edit:

The question is clearer now

I'd like a user to only be able to read objects that they created.

I'll demonstrate via the following:

A Firebase structure:

posts
  post_0
    created_by: uid_0
    msg: some message
  post_1
    created_by: uid_1
    msg: another message
  post_2
    created_by: uid_2
    msg: yippee

and the rules that will allow a user to only read from the post node they created

"rules": {
    ".read": false,
    ".write": false,
    "posts": {
      ".read": false,
      "$post_id": {
        ".read": "root.child('posts').child($post_id).child('created_by').val() == auth.uid",
        ".write": "auth != null"
      }
    }
  }

then the code to test. We assume the current users uid is uid_0:

let reference = self.myRootRef.childByAppendingPath("posts/post_0")

reference.observeEventType(.ChildAdded, withBlock: { snapshot in

        print(snapshot.value)

    }, withCancelBlock: { error in

        print(error.description)    
})

The above code will allow a read from node post_0 which is the post uid_0 created as indicated by the created_by child.

If the path is changed to posts/posts_1 (or anything else) for example, the read is denied.

This answer my not directly answer the question as if you are expecting the rules to 'block' or 'filter' the resultant data, that isn't what rules are for (per the other answer).

So you may want to go down a different path by constructing a query to pull out just the posts you want to work with based on the created_by = auth.uid like this

let reference = self.myRootRef.childByAppendingPath("posts")

reference.queryOrderedByChild("created_by").queryEqualToValue("uid_1")
    .observeEventType(.Value, withBlock: { snapshot in

            print(snapshot.value)

        }, withCancelBlock: { error in

            print(error.description)    
    })