Ggtcf

What is the offset in a seaplane's hull?

Schwarzchild Radius of the Universe

What typically incentivizes a professor to change jobs to a lower ranking university?

Could a US political party gain complete control over the government by removing checks & balances?

What do you call something that goes against the spirit of the law, but is legal when interpreting the law to the letter?

How to use Pandas to get the count of every combination inclusive

DOS, create pipe for stdin/stdout of command.com(or 4dos.com) in C or Batch?

N.B. ligature in Latex

Need help identifying/translating a plaque in Tangier, Morocco

Why is an old chain unsafe?

What is the command to reset a PC without deleting any files

Can you lasso down a wizard who is using the Levitate spell?

Draw simple lines in Inkscape

Motorized valve interfering with button?

The use of multiple foreign keys on same column in SQL Server

How can the DM most effectively choose 1 out of an odd number of players to be targeted by an attack or effect?

Can an x86 CPU running in real mode be considered to be basically an 8086 CPU?

What is the white spray-pattern residue inside these Falcon Heavy nozzles?

Why are 150k or 200k jobs considered good when there are 300k+ births a month?

I’m planning on buying a laser printer but concerned about the life cycle of toner in the machine

Is there really no realistic way for a skeleton monster to move around without magic?

How to determine if window is maximised or minimised from bash script

Is Social Media Science Fiction?

I see my dog run

Odd database structure for Firestore security rules - Need Recommendations

What's the difference between Cloud Firestore and the Firebase Realtime Database?Firestore security rules for public and private fieldsFirestore security rules - How to add collections wildcardsFirestore Security RulesFirestore rule on condition from a different collectionCloud Firestore RuleDoes firestore rule simulator account for existing documents actual collections?Firestore write security rule for specific user using auth namesFirestore Rules: validate data does not have fieldFirestore Security Rules: 'request.auth.uid' Is Null With Android Request

.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty height:90px;width:728px;box-sizing:border-box;

0

I have a Firestore database for an app where a user will authenticate using email and password in a 3rd-party API which returns their account id, user id, and api token.

If a Firestore user with their email does not exist already, I create one. I then check the Firestore db to see if there is a document for that account id already. If not, I create one, and create a sub-collection for 'users', then add their data as a users document and include the fields isAllowed and isAdmin both as true, and store their firebase user id.

In the admin page of the app, I query their account id in the 3rd party API and return all users in their account. The admin then has the ability to allow other users access to the app and optionally mark them as admins as well. These permissions are stored by adding the user data as documents in the Firestore/account id/users collection with isAllowed and isAdmin set accordingly.

At this point, these additional users do not have firebase accounts, so I am using the user id from the 3rd party as the 'users' document name for everyone. With my knowledge, this makes Firebase security rules hard because I do not have a relationship between the Firebase account data passed into the security rules and the database data.

My desired rules are:

1. If no account id exists, allow the creation of account and users


2. If account id exists, allow read-only for account data and only their user IF the user exists in the users collection and isAllowed = true


3. If #2 is true, allow write access to the entire account if isAdmin = true

Does this make sense? Any thoughts or suggestions?

Thank you.

firebase google-cloud-firestore firebase-security-rules

share|improve this question

edited Mar 9 at 3:51

Doug Stevenson

83.7k10100118

asked Mar 9 at 3:49

Armand FarrArmand Farr

1

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Hey Armand, welcome to Stack Overflow. As you may have noticed, nobody answered or commented in the first 12 hours after you posted. You'll find that typically people here are much more likely to respond if you include the actual code, data structure, and security rules in your question, instead of descriptions of them. It also helps if you have a single concrete question about something specific in your code, instead of the broad questions you have now. For more on this, see how to create a minimal, complete, verifiable example
  
  – Frank van Puffelen
  Mar 9 at 15:55
  

  
  
  
  

add a comment | 

0

I have a Firestore database for an app where a user will authenticate using email and password in a 3rd-party API which returns their account id, user id, and api token.

If a Firestore user with their email does not exist already, I create one. I then check the Firestore db to see if there is a document for that account id already. If not, I create one, and create a sub-collection for 'users', then add their data as a users document and include the fields isAllowed and isAdmin both as true, and store their firebase user id.

In the admin page of the app, I query their account id in the 3rd party API and return all users in their account. The admin then has the ability to allow other users access to the app and optionally mark them as admins as well. These permissions are stored by adding the user data as documents in the Firestore/account id/users collection with isAllowed and isAdmin set accordingly.

At this point, these additional users do not have firebase accounts, so I am using the user id from the 3rd party as the 'users' document name for everyone. With my knowledge, this makes Firebase security rules hard because I do not have a relationship between the Firebase account data passed into the security rules and the database data.

My desired rules are:

1. If no account id exists, allow the creation of account and users


2. If account id exists, allow read-only for account data and only their user IF the user exists in the users collection and isAllowed = true


3. If #2 is true, allow write access to the entire account if isAdmin = true

Does this make sense? Any thoughts or suggestions?

Thank you.

firebase google-cloud-firestore firebase-security-rules

share|improve this question

edited Mar 9 at 3:51

Doug Stevenson

83.7k10100118

asked Mar 9 at 3:49

Armand FarrArmand Farr

1

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Hey Armand, welcome to Stack Overflow. As you may have noticed, nobody answered or commented in the first 12 hours after you posted. You'll find that typically people here are much more likely to respond if you include the actual code, data structure, and security rules in your question, instead of descriptions of them. It also helps if you have a single concrete question about something specific in your code, instead of the broad questions you have now. For more on this, see how to create a minimal, complete, verifiable example
  
  – Frank van Puffelen
  Mar 9 at 15:55
  

  
  
  
  

add a comment | 

I have a Firestore database for an app where a user will authenticate using email and password in a 3rd-party API which returns their account id, user id, and api token.

If a Firestore user with their email does not exist already, I create one. I then check the Firestore db to see if there is a document for that account id already. If not, I create one, and create a sub-collection for 'users', then add their data as a users document and include the fields isAllowed and isAdmin both as true, and store their firebase user id.

In the admin page of the app, I query their account id in the 3rd party API and return all users in their account. The admin then has the ability to allow other users access to the app and optionally mark them as admins as well. These permissions are stored by adding the user data as documents in the Firestore/account id/users collection with isAllowed and isAdmin set accordingly.

At this point, these additional users do not have firebase accounts, so I am using the user id from the 3rd party as the 'users' document name for everyone. With my knowledge, this makes Firebase security rules hard because I do not have a relationship between the Firebase account data passed into the security rules and the database data.

My desired rules are:

1. If no account id exists, allow the creation of account and users


2. If account id exists, allow read-only for account data and only their user IF the user exists in the users collection and isAllowed = true


3. If #2 is true, allow write access to the entire account if isAdmin = true

Does this make sense? Any thoughts or suggestions?

Thank you.

firebase google-cloud-firestore firebase-security-rules

share|improve this question

edited Mar 9 at 3:51

Doug Stevenson

83.7k10100118

asked Mar 9 at 3:49

Armand FarrArmand Farr

1

share|improve this question

edited Mar 9 at 3:51

Doug Stevenson

83.7k10100118

asked Mar 9 at 3:49

Armand FarrArmand Farr

1

share|improve this question

edited Mar 9 at 3:51

Doug Stevenson

83.7k10100118

asked Mar 9 at 3:49

Armand FarrArmand Farr

1

edited Mar 9 at 3:51

Doug Stevenson

83.7k10100118

edited Mar 9 at 3:51

Doug Stevenson

83.7k10100118

asked Mar 9 at 3:49

Armand FarrArmand Farr

1

asked Mar 9 at 3:49

Armand FarrArmand Farr

1