Why is the firebase security rules not working? - ios

Question

I'm using RealTime DataBase for my application, it has security rules:
{
"rules": {
".read": "auth.uid != null",
".write": "auth.uid != null"
}
}
This is the code snippet where the data is getting:
func firstLaunchCataloguePartsFetchData(
result : #escaping((Result<[CatalogueParts], Error>) -> Void)
) {
if ConnectionManager.shared.isConnected {
let baseUrl = Constants.baseUrl + DirectoryType.catalogueParts.addJsonAbbreviation
guard let url = URL(string: baseUrl ) else { return }
URLSession.shared.dataTask(with: url) {data, response, error in
if let error = error {
result(.failure(error))
} else if let data = data,
let jsonString = String(data: data, encoding: .utf8),
let downloadedMarks = Mapper<CatalogueParts>().mapArray(JSONString: jsonString) {
result(.success(downloadedMarks))
} else {
result(.success([]))
}
}
.resume()
} else {
let error = NSError(domain: "Connection error detected", code: 911, userInfo: nil)
result(.failure(error))
}
}
Here I am using the received data to draw a table view:
func getFirstLaunchCatalogueParts() {
ShopManager.shared.firstLaunchCataloguePartsFetchData { [weak self] result in
guard let self = self else { return }
switch result {
case .success(let catalogueParts):
self.catalogueParts = catalogueParts
DispatchQueue.main.async {
self.tableView.reloadData()
}
case .failure(let error as NSError):
self.showErrorAlert(error: error, withAction: nil)
}
}
}
Even if I'm authorized, passed phone authorization (Auth.auth().currentUser?.uid has somevalue) - i can't display the tableView, received data is nil
But!
This works great, the table is rendered, everything works if the rules are made like this:
{
"rules": {
".read": "true",
".write": "auth.uid != null"
}
}

Answer 1

In my opinion the problem was this:
I was accessing Firebase using this method, it is not the basic method of reading firebase service data
let baseUrl = Constants.baseUrl + ".JSON"
// where baseUrl is just http path to my database and if you add ".JSON" to it - you
// open the contents of the database in Json
guard let url = URL(string: baseUrl ) else { return }
URLSession.shared.dataTask(with: url) {data, response, error in
Then I used the given Data to parse through the model:
let jsonString = String(data: data, encoding: .utf8),
let downloadedDataAsModel = Mapper<CatalogueParts>().mapArray(JSONString: jsonString)
The problem is that using this method, regardless of the rules - you get the data in any case, while the ObjectMapper processes and creates an instance, but it is incomplete, and no error occurs here
let downloadedDataAsModel = Mapper<CatalogueParts>().mapArray (JSONString: jsonString)
Therefore, this method does not allow rule settings other than "read : true"
I tried using this method and everything really worked - depending on the authorized status, access was allowed or restricted. Now it remains to decide how to use this method to get data in the form of Json for further processing =)
func fetchData(){
let ref = Constants.ref
ref.child("CatalogueParts").getData { error, snapshot in
guard error == nil else {
print(error!.localizedDescription)
return;
}
let someValue = snapshot.value
print(someValue)
}
}