Firebase security rules getting a value from another node and comparing it with auth.uid

Viewed 267

I am having difficulties with setting up the Firebase security rules by taking the value of another node and comparing it with auth.uid

My structure is as follows:

/$environment
/$environment/data/$client_id
/$environment/users/$uid/client_id

I would like to make sure that the authenticated user with auth.uid can only view the data at $client_id if $uid/client_id is equivalent.

I tried the following but in the simulator it says access denied:

{
  /* Visit https://firebase.google.com/docs/database/security to learn more about security rules. */
  "rules": {
    ".write": false,
    "$environment": {

      /* Data */
      "data": {
        "$client_id": {
            ".read": "$client_id === root.child($environment+'/users/'+auth.uid+'/client_id').val()"
        }
      },

      /* Account settings */
      "users": {
        "$uid": {
          ".read": "$uid === auth.uid"
        }
      }

    /* --------------------------------*/
    /* end environment, rules and json */
    }
  }
}
0 Answers
Related