{
"rules": {
"Users": {
"$user_id": {
// Grants write access to the owner of this user account
// whose uid must exactly match the key ($user_id)
".write": "$user_id === auth.uid"
}
}
"$businessName": {
".write": "root.child('Users').child(auth.uid).child($businessName).child('Permission s').val() === 'MODERATOR'"
}
}
}
This is giving me an error:
Error saving rules - Line 10: Expected ',' or '}'.
The error says I'm missing a bracket for some reason. Did I miss a comma or something?
As #Frank van Puffelen said I was just missing a comma before "$businessName".
Related
When I try to update data in realtime-database with null, ".validate" in database.rules.json seems to be ignored.
I have a database.rules.json in the following format (not the exact same way, but this shows what I expect at least).
database.rules.json
"data": {
".read": "auth != null",
".write": "auth != null",
".validate": "newData.val() != null"
}
When I update realtime-database with
frontend.js
import { set } from 'firebase/database';
export class PublishService {
...
setWithData(value) {
// suppose dbReference has ref to "data"
// something like ref(this.database, "data")
set(this.dbReference, value);
}
}
where value == null,
I can still update realtime-database with null even though this isn't what I expect.
Is this how realtime-database is supposed to work?
If that's the case, is there any documentation that says that?
The .validate rule is not triggered for data deletions. From the documentation on .validate rules:
the validate definitions are ignored when data is deleted (that is, when the new value being written is null).
So you'll want to check for newData.exists() in the .write rule.
i want to write firebase realtime database rule where certain user can only write cetain key
ex: user with UID underlined in red can write value of key franchise_active only
user with UID underlined in green can write value of key vendor_active only
both users can read
Sounds possible. Something like this should work:
{
"rules": {
"application_status": {
"$uid1": {
"$uid2": {
"franchise_active": {
".write": "auth.uid === $uid1"
},
"vendor_active": {
".write": "auth.uid === $uid2"
}
}
}
}
}
}
In my firebase database, I have set the following rule:
{
"rules": {
"Users": {
"$uid": {
".write": "$uid === auth.uid",
".read": "$uid === auth.uid"
}
}
}
}
I am developing iOS app with Firebase. I use Facebook authentication to login to my app, I would like to add user id to database when the login is successful, this is my code:
let ref = Database.database().reference()
...
// I got uid
ref.child("Users").setValue(uid)
But I got error:
setValue: or removeValue: at /users failed: permission_denied
Why?
You don't have permission to write a value to /users, so the operation is denied.
You do have permission to write a value to /users/$uid. You're probably trying to do something like this:
ref.child("Users").child(uid).setValue(true)
May I ask what runTransactionBlock is doing behind the hood? When I run a simple setValue with the exact same rules it works, but not with runTransactionBlock. I suspect that behind the hood runTransactionBlock writes to paths outside of just the path I stated, which is causing my security rules to deny permission. Hence, I have to write a global ".write": "auth != null" and avoid doing stuff such as my wildcard ".validate": false.
My security rules are mapped out this way:
{
"rules": {
// NOTE: I NEED THIS GLOBAL WRITE ALLOW FOR TRANSACTION TO WORK
".write": "auth != null",
"real_db": {
// USERS
"users": {
"$user": {
".read": "auth != null",
"$other": {
// NOTE: I NEED TO COMMENT VALIDATE FOR OTHER FIELDS IN USER
// ".validate": false
},
"pushToken": {
".read": "auth != null",
".validate": "auth != null"
},
...
My runTransactionBlock is run on the path real_db/users/$uid and I am changing the value of pushToken. When setValue is run on this same path and modifying pushToken it works.
My rules are:
{
"rules": {
".read": true,
".write": true,
"Recent": {
".indexOn": ["userID", "chatRoomID"]
}
}
}
Still I'm getting:
[FirebaseDatabase] Using an unspecified index. Consider adding
".indexOn": "chatroomID" at /Recent to your security rules for better
performance
How do I have to set it properly? I have tried the last 20 minutes, but can't get is right. Help is very appreciated.
Your rules say ".indexOn": ["userID", "chatRoomID"] but your error says chatroomID.
chatroomID is not the same as chatRoomID.