Granting access to Firebase locations to a group of users

I couldn't find it in the docs but is there a way to define a group of users and use that group to grant access to different locations, rather than granting access to individual users?

Regards, LT

Solution 1:

There's no explicit support for "groups" in Firebase, because you can represent them yourself quite easily. Here are two options, depending on your situation.

Storing group information in firebase.

The following data could be used to represent 2 groups ('alpha' and 'beta') and 3 pieces of protected data ('thing1', 'thing2', and 'thing3')

{
  "groups": {
    "alpha": {
      "joe": true,
      "sally": true
    },
    "beta": {
      "joe": true,
      "fred": true
    }
  },
  "data": {
    "thing1": {
      "group": "alpha"
      /* data accessible only by the "alpha" group */
    },
    "thing2": {
      "group": "beta"
      /* data accessible only by the "beta" group */
    },
    "thing3": {
      "group": "alpha"
      /* more data accessible by the "alpha" group */
    }
  }
}

Then we can use the following rules to enforce security:

{
  "rules": {
    "data": {
      "$thing": {
        ".read":  "root.child('groups').child(data.child('group').val()).hasChild(auth.id)",
        ".write": "root.child('groups').child(data.child('group').val()).hasChild(auth.id)"
      }
    }
  }
}

So then if I'm authenticated with { id: 'sally' } as my auth object, I'll have access to thing1 and thing3, but not thing2.

Storing group information in the auth token.

If you're generating your own auth tokens and you know what groups a user is in at the time they auth, you could store the list of groups in the auth token you generate. For example, when you generate the auth token for user 'fred', include "{ id: 'fred', groups: { alpha: true, beta: true } }"

And then you can enforce group membership with:

{
  "rules": {
    "data": {
      "$thing": {
        ".read": "auth[data.child('group').val()] != null",
        ".write": "auth[data.child('group').val()] != null"
      }
    }
  }
}