Creating an admin/supervisor account to access team accounts in firebase/firestore

user_13803561 0
Viewed 172

I am building an admin UI for an app (in firebase/firestore) that allows supervisor admins to access their team's individual user accounts and view their dashboards / data directly. Since this is essentially identical to creating an admin for different user groups, I imagine that it can be accomplished with custom claims. The problem is that I am having trouble implementing this without weakening the firestore rules that protect our user account data or storing login credentials within the 'admin account' firestore profile doc. Could someone help me understand what I am missing here? Thank you!

This is a snippet from the current firestore rules we have in place.

    match /teams/{team}{
        allow create
        allow read: if (request.auth.token.role == 'member' || request.auth.token.role == 'supervisor') && request.auth.token.email_verified == true
        allow update, delete: if (request.auth.token.role == 'member' || request.auth.token.role == 'supervisor') && request.auth.token.email_verified == true
    }
    match /supervisors/{supervisor}
    {
        allow create
        allow read: if (request.auth.token.role == 'supervisor' || request.auth.token.role == 'member') && request.auth.token.email_verified == true
        allow update, delete: if request.auth.token.role == 'supervisor' && request.auth.uid == supervisor && request.auth.token.email_verified == true
    }
google-cloud-firestore firebase-authentication firebase
1 Answers

Well I would suggest to not to create two DB and go with single database "teams" in which create a role for supervisor assigning the particular team name aswell. Create a security rule to check if the person is supervisor of that particular team(by checking team name parameter) or not.

Edit: you can add iSSupervisor and SupervisorOf (the name of team) as a parameter actually and can add security rule like

function notAllowedChange(field) {
      //Parameters not allowed to be changed
      return !(field in request.resource.data) || (field in resource.data && resource.data[field] == request.resource.data[field]);
    }
match /teams/{userId} {
     allow write: if userId == request.auth.uid
      && notAllowedChange('iSSupervisor') && notAllowedChange('SupervisorOf');
     allow write: if get(/databases/$(database)/documents/teams/$(request.auth.uid)).data.iSSupervisor == true && get(/databases/$(database)/documents/teams/$(request.auth.uid)).data.SupervisorOf == resource.data.teamName;
     allow read: if true;
    }

Hope this helped you! Sorry for including the code later.

user_129429320
Related