StackOverflow2013

Note that there are some explanatory texts on larger screens.

plurals

PO
text
Body
copied!<p>There's no explicit support for "groups" in Firebase, because you can represent them yourself quite easily. Here are two options, depending on your situation.</p> <h1>Storing group information in firebase.</h1> <p>The following data could be used to represent 2 groups ('alpha' and 'beta') and 3 pieces of protected data ('thing1', 'thing2', and 'thing3')</p> <pre><code>{ "groups": { "alpha": { "joe": true, "sally": true }, "beta": { "joe": true, "fred": true } }, "data": { "thing1": { "group": "alpha" /* data accessible only by the "alpha" group */ }, "thing2": { "group": "beta" /* data accessible only by the "beta" group */ }, "thing3": { "group": "alpha" /* more data accessible by the "alpha" group */ } } } </code></pre> <p>Then we can use the following rules to enforce security:</p> <pre><code>{ "rules": { "data": { "$thing": { ".read": "root.child('groups').child(data.child('group').val()).hasChild(auth.id)", ".write": "root.child('groups').child(data.child('group').val()).hasChild(auth.id)" } } } } </code></pre> <p>So then if I'm authenticated with { id: 'sally' } as my auth object, I'll have access to thing1 and thing3, but not thing2.</p> <h1>Storing group information in the auth token.</h1> <p>If you're generating your own auth tokens and you know what groups a user is in at the time they auth, you could store the list of groups in the auth token you generate. For example, when you generate the auth token for user 'fred', include "{ id: 'fred', groups: { alpha: true, beta: true } }"</p> <p>And then you can enforce group membership with:</p> <pre><code>{ "rules": { "data": { "$thing": { ".read": "auth[data.child('group').val()] != null", ".write": "auth[data.child('group').val()] != null" } } } } </code></pre>

Querying!

Guidance

An individual column

Larger individual text columns get their own page to allow for proper reading.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload