This could potentially be tricky security-wise. Our Firebase rules can check when a new network is being created (ie the old data doesn't exist) and enforce that the creator and only the creator is an admin. But it's harder, when the network already exists and we're adding more admins, to verify that the request to add an admin is coming from an admin and not someone malicious trying to add themselves.
Maybe we could do some kind of token exchange: the existing admin sends the potential new admin an invitation with a token. When the new admin accepts the invitation they make a request to add themselves to the list of admins using the token as verification. While the invitation is pending we store the token in Firebase somewhere, then when the request comes in we compare it to the stored token, add the new admin (assuming the token checks out) and then destroy the token.
This could potentially be tricky security-wise. Our Firebase rules can check when a new network is being created (ie the old data doesn't exist) and enforce that the creator and only the creator is an admin. But it's harder, when the network already exists and we're adding more admins, to verify that the request to add an admin is coming from an admin and not someone malicious trying to add themselves.
Maybe we could do some kind of token exchange: the existing admin sends the potential new admin an invitation with a token. When the new admin accepts the invitation they make a request to add themselves to the list of admins using the token as verification. While the invitation is pending we store the token in Firebase somewhere, then when the request comes in we compare it to the stored token, add the new admin (assuming the token checks out) and then destroy the token.