FirebaseExtended / firechat

Real-time Chat powered by Firebase
https://firechat.firebaseapp.com
MIT License
2.42k stars 1.04k forks source link

The rules from firechat/rules.json don't work in the simulator #83

Open deepakbhatia opened 7 years ago

deepakbhatia commented 7 years ago
 `{
       "rules": {
           ".read": false,
          ".write": false,
             "room-metadata": {
                   //".read": "(auth != null) && (!data.exists() || data.hasChild(auth.uid))",
                    ".read": true,
                  "$roomId": {
                  // Append-only by anyone, and admins can add official rooms, and edit or remove           rooms as well.
                 ".write": "(auth != null) && (!data.exists() || data.child('createdByUserId').val() === auth.uid)",

    ".validate": "newData.hasChildren(['name','type'])",
    "id": {
      ".validate": "(newData.val() === $roomId)"
    },
    "createdByUserId": {
      ".validate": "(auth.uid === newData.val())"
    },
    "numUsers": {
      ".validate": "(newData.isNumber())"
    },
    "type": {
      ".validate": "'private' === newData.val()"
    },
    // A list of users that may read messages from this room.
    "authorizedUsers": {
      ".write": "(auth != null) && (!data.exists() || data.hasChild(auth.uid))"
      }
    }
    }
  }
}`

Even replacing this ".write": "(auth != null) && (!data.exists() || data.child('createdByUserId').val() === auth.uid)" under $roomId

with ".write":true does not work

Unless I put ".write":true with the rules as root.

I have to put the checking in the .validate section for doing the auth check.

I have to do this, ".validate": "newData.hasChildren(['name','type']) && newData.child('createdByUserId').val() === auth.uid"

So is this now the way to do it or is this an error. Or I am doing something odd.

deepakbhatia commented 7 years ago

Update:

Adding this ".write":"(auth != null) && (!data.exists() || data.child('createdByUserId').val() === auth.uid)"

below "room-metadata" with ".write":false under "rules" works.

No additional auth checks needed in ".validate".