Firebase 安全规则

Question

我在 firebase 中有以下格式的数据 -

  "requests" : {
    "-KpPjt5jQZHBalQRxKSK" : {
      "email" : "pariksheet@agsft.com",
      "itemId" : "-KmazkKp5wavdHOczlDS",
      "quantity" : 1,
      "status" : "new"
    },
    "-KpZsw3KHE9oD1CIFQ4R" : {
      "email" : "pbarapatre@gmail.com",
      "itemId" : "-Kmb-ZXfao7VdfenhfYj",
      "quantity" : 1,
      "status" : "new"
    }
  }

每个请求包含

"email" <- user's email id who has initiated the request.
"itemId" <- id of requested item
"quantity" <- item quantity
"status" <- "new" | "approved" | decline.

我正在努力编写 Firebase 规则：

仅允许经过身份验证的用户 access/read 由 him/her 提出的请求。
允许管理员用户 read/update 所有请求。

我目前的规则如下：

{
  "rules": {
    ".read": false,
    ".write": false,
    "items" : {
    ".read": "auth != null",
    ".write": "root.child('roles').child(auth.uid).val() === 'admin'"
    },
    "requests": {
        ".write": "root.child('roles').child(auth.uid).val() === 'admin'", /*Only Admins can update request*/
        "$rId": {
            ".read": "data.child('email').val() == auth.email || root.child('roles').child(auth.uid).val() === 'admin'"/*Request owner and admin can only read the particular request*/
        }
    }
  }
}

我维护了单独的节点角色 { "uid" : "role" }

我正在使用 AngularFire2 在我的应用程序中查询 Firebase。

检索具有给定状态的请求的示例代码如下

const queryList$ = this.db.list('/requests', {
    query: {
        orderByChild: 'status',
        equalTo: status
    }
})

谢谢帕里

Answer 1

我建议您进行以下更改：

在数据库的根目录下创建一个新对象admins

"admins": {
    "<ADMIN_1_UID>": "true",
    "<ADMIN_2_UID>": "true"
}

然后像这样更改您的安全规则：

"rules": {
    "admins": {
        ".read": false,
        ".write": false /*This ensures that only from firebase console you can add data to this object*/
    },
    "requests": {
        ".read": "root.child('admins').child(auth.uid).val()",
        ".write": "root.child('admins').child(auth.uid).val()", /*Only Admins can read/update all requests*/
        "$rId": {
            ".read": "data.child('email').val() == auth.email"/*Request owner can read only the particular request*/
        }
    }
}

Firebase 安全规则

Firebase Security rule

firebase

firebase-security

firebase-realtime-database