angularfire - Firebase Security API - Complex Data Structure - How to enforce relationships? -

angularfire - Firebase Security API - Complex Data Structure - How to enforce relationships? -

for past few weeks i've been exploring firebase , features build web app, i've kind of ran wall when comes security rules.

i've build info construction on firebase i'm not sure if follows best practices (if doesn't, sense free suggest different it):

{ "groups" : { <group_key> "name": "", "rels": { "users": { <rels_users_key> "key":"" (user_key) }, "notes": { <rels_notes_key> "key":"" (note_key) } }, "isprivate": true }, "users": { <user_key> "email": "", "rels": { "friends": { <rels_friends_key> "key":"" (user_key) } }, }, "notes": { <note_key> "title": "", "description": "", "rels": { "files": { <rels_files_key> "key":"" (file_key) } } }, "files": { <file_key> "mode": "", "url": "" } }

the application flow follows:

the user signs up: key created on "users"; is redirected "groups" view, he should shown groups have id in rels > users, or has "isprivate":"false"; as user creates group, new grouping added id in rels > users; entering grouping view, should see notes in rels > notes group.

the rest of logic follows same principle, , believe if can through first hurdle of understanding firebase security rules , applying them case, can through rest.

i've tried couple of rules, can't seem feedback @ web application, debugging has been trial-and-error process, , not working.

could help me @ to the lowest degree understanding logic behind ? i've read of tutorials seem shallow no deeper examples on complex structures.

thanks help.

edit

i've added debug:true flag login (thanks @kato), i'm still getting no feedback on rules. rules below, still come in "groups" view, no feedback on console, , logged-in user sees groups shouldn't:

{ "rules": { "groups": { ".read": "data.child('rels').child('users/' + auth.user).exists()", ".write": "data.child('rels').child('users/' + auth.user).exists()" } } }

as rules i've tried, countless, recent 1 (still no feedback).

maybe i'm missing ?

thanks again.

rules cascade. is, if rule allows read, cannot revoke later in nested child. in way, can write rules following:

"$record": { // can write entire record if own ".write": "data.child('owner').val() === auth.uid", "foo": { // in friends list can write foo, not else in $record ".write": "data.parent().child('friends/'+auth.uid).exists()" }, "bar": { // superfluous permissions "granted" , never "revoked" kid ".write": false } }

note how, because owner, can write foo , bar, though bar has tried revoke read privilege.

so in case above, rules declaration lists read: true allows total read access entire repo. alter false , you'll see improve results.

firebase angularfire firebase-security