1

I have the following data structure:

/users/$userId/profile/...
/users/$userId/job/...
/users/$userId/personal/...

Suppose that I want to read some data about users' job and profile and show it as a list. There are 2 (related) problems here:

1. How can I set the .read security rule. If I say:

"users": { 
    ".read": "auth != null",
    ...
}

then the rule cascades. Why can't I replicate the same rule three times under the three different paths? because, then I get an error while joining the paths together. Consider this:

var ref = fbutil.ref();     
var refSearch = new Firebase.util.NormalizedCollection(
                [ref.child('users'), 'usrId']
            ).select('usrId.job', 'usrId.profile').ref(); 
var result = refSearch.orderByChild("profile/name");
return $firebaseArray(result);

If I have three different rules under the three paths, the above would fail, because it cannot read the usrId itself.

2. I'm not sure if using NormalizedCollection is the best solution here. Is there any other way to join the 2 paths? This could help solve the first problem as well.

So, how can I join the 2 path (/users/$userId/profile/ and /users/$userId/job/) without making the '/users/$userId' path readable?

Jaime Gómez
  • 6,961
  • 3
  • 40
  • 41
towi_parallelism
  • 1,421
  • 1
  • 16
  • 38

1 Answers1

0

If you need to have a separation between public and private data, make that part of your structure:

{
    "rules": {
        "users": {
            "$user_id": {
                private: {
                    ".read": "$user_id === auth.uid"
                }
                public: {
                    ".read": "true",
                    "job": {},
                    "profile": {}
                }
            }
        }
    }
}
Jaime Gómez
  • 6,961
  • 3
  • 40
  • 41
  • Tnx @Jaime, but that doesn't help. As you said, rules cascade, so, there is no need to add $user_id. I'd like to allow users to see other users' profile and job, but not the personal data. The problem is when I try to join the 2 paths. such a join needs read access on `userId`, hence the whole branch – towi_parallelism Oct 13 '16 at 20:53
  • Sorry, I hadn't understood the intent from your question, edited my answer :) – Jaime Gómez Oct 13 '16 at 23:52
  • Thanks Jaime! It's funny that I had the same structure for other fields but not for users. In my case though (I have other joins from other paths), userIds should be under public/private (duplicated) – towi_parallelism Oct 14 '16 at 10:51