Firebase Security Rules for a data sharing app

Question

I am working on a simple react-native To-do app with sharing features. I am using Firebase Storage for storage and sharing. However, I am a beginner to Firebase and couldn't understand how to proceed. My requirements are as follows

Each user can add/remove/edit their own database entry.
User A should be able to share some of their To-dos with User B. The share can be in either view or edit mode (exactly like a Google Drive file).
An option to permanently allow User B to see all future view or edit mode for any new to-dos. Basically, an option to allow or disallow User B to see the data.

My attempt: Bullet 1 can be achieved simply by

// These rules grant access to a node matching the authenticated
// user's ID from the Firebase auth token
{
  "rules": {
    "users": {
      "$uid": {
        ".read": "$uid === auth.uid",
        ".write": "$uid === auth.uid"
      }
    }
  }
}

source

For Point 2 and Point 3, I plan to have a separate JSON file accessible by all the users. So when user A gives edit access to some of its data to User B, the JSON file for user B should be updated with A's uid. I am not able to write security rules for this because I am not aware if we can write rules to get data from a JSON file. Also, this method is not very good in my opinion, as some attacker may flood User B's JSON file with garbage entries and in fact can delete the existing entries also.

Any help to achieve this Google Drive-like sharing feature for Firebase storage will be appreciated. Thanks!

user_8162191 · Answer

You can allow who can write or read particular path in rules if your database looks something like this:- your rule can look something like this:-

     "rules": {
        "$uid":{
          "$todoid":{
            "todoitem":{
              ".read":"$uid == auth.uid || data.parent().child('sharedwith').child(auth.uid).val() === 'editor' || data.parent().child('sharedwith').child(auth.uid).val() === 'editor'",
                ".write":"$uid == auth.uid || data.parent().child('sharedwith').child(auth.uid).val() === 'editor'"
            }
          }
        }
  }

you can follow this blog post to understand better:- https://firebase.googleblog.com/2016/10/group-security-in-firebase-database.html

user_15136333 · Answer

Am glad that you are trying to work with Firebase Realtime Database Rules.

Firstly I guess you understood concept of rules in a different way. The rules in firebase is not built to have User specific data control. These rules are used to give certain data access to certain type of users

For example :

You can give R/W permission to specific child to the users who are only Authenticated. For the one who not authenticated we can restrict the access

Main motive of this Rules tab is to avoid Data breaching from a 3rd party access

To know more about firebase rules please watch video in the given. link

https://www.youtube.com/watch?v=PUBnlbjZFAI

You can also see this Documentation

https://firebase.google.com/docs/database/security

Firebase Security Rules for a data sharing app

2 Answers