Firebase: Cannot add user entry (`set` permission denied)

dominic Published at Dev

Dominic

I want to ensure that a new user can be created (from the client), but only an authenticated user can read or write an existing object.

I have a simple rule set:

{
    "rules": {
        "users": {
          "$uid": {
              ".read": "auth != null && auth.uid === $uid",
              ".write": "!data.exists() || auth.uid === $uid"
          }
        }
    }
}

I am calling createUser and then in the callback I'm trying to add an entry to my own users object:

const usersRef = ref.child('users');

const userEntry = {
    [userData.uid]: {
        created: new Date().getTime()
    }
};

usersRef.set(userEntry)

I would have thought that even though the user is not yet logged in, they should have write permission because of !data.exists(). Yet I am getting a PERMISSION_DENIED error.

If I set ".write": true on the users level then it will cascade (and override?) my inner rules won't it?

Edit:

This fails even with:

"users": {
  "$uid": {
      ".read": true,
      ".write": true
  }
}

Thanks.

lossleader

I think I initially misunderstood the problem. In your current callback, you are trying to overwrite the entire users level because of how set works.

You would really want to set only the thing that doesn't exist:

const userRef = ref.child('users').child(userData.uid);

const userEntry = {
        created: new Date().getTime()
    };

userRef.set(userEntry);

Then, I think that your existing rules would work.

Collected from the Internet

Please contact [email protected] to delete if infringement.

edited at2021-02-28

Comments

0 comments

From Dev

Related Related

Article