0

In my DB I have "users" and those users have a variety of nodes attached to them. I want some nodes to be available, and some to be hidden. 

{
  "rules": {
    "users": {
      "$userId": {
        "dateOfBirth": {
          ".read": "auth != null",
          ".write": "$userId === auth.uid"
        }, 
        "gender": {
          ".read": "$userId === auth.uid",
          ".write": "$userId === auth.uid"
        },

The above makes logical sense to me but it doesn't work - the user can't gain access to the "$userId" layer, which it needs to be able to access the rest of the nodes. However, if I add a "read" entry to the "users" level, it overwrites any attempts to deny access at a lower level, for "gender" for example.

{
  "rules": {
    "users": {
     ".read": true // Added this
      "$userId": {
        "dateOfBirth": {
          ".read": "auth != null",
          ".write": "$userId === auth.uid"
        }, 
        "gender": {
          ".read": "$userId === auth.uid",
          ".write": "$userId === auth.uid"
        },

To even reach the dateOfBirth of a different user, their user ID has to be read. So I need to give permission to read the user ID whilst allowing the lower down rules to still take effect.

Doug Stevenson
  • 297,357
  • 32
  • 422
  • 441
Spencer Deane
  • 35
  • 5
  • Consider splitting your rules into two user-level children - one for public data, and another for private. You can then write rules to protect them independently. – Doug Stevenson Jun 17 '20 at 17:41
  • Sorry, what do you mean by "two user-level children"? Are you suggesting I split the nodes in my database into private and public folders? – Spencer Deane Jun 17 '20 at 17:50
  • Yes, but they are called "children" or "nodes", not folders. – Doug Stevenson Jun 17 '20 at 17:51
  • The issue with that solution is that I still don't think it would work - to even access anything inside the private node I would need to read the user ID at the top of the node, which would cause the entire private child to be readable. – Spencer Deane Jun 17 '20 at 17:54

0 Answers0