firebase - Rules for a many to many (join object) association -

firebase - Rules for a many to many (join object) association -

i have assignment object "joins" project service. many users can work on given assignment (or service project).

user has many assignments project has many assignments assignment has many users assignment belongs project and service

here snapshot of sample info visual.

users: { 1: { name: 'john smith', assignments: { 1: true } }, 2: { name: 'jane doe', assignments: { 1: true } } } projects: { 1: { title: 'project #1', assignments: { 1: true } } } services: { 1: { title: 'service #1' } } assignments: { 1: { service: 1, project: 1, users: { 1: true, 2: true } } }

i'm trying write security rule a project can read users assigned it. far can figure out how assignments given project.

root.child('assignments')[data.child('assignments')]

when nested under "$project" rule homecoming array of assignments. how can observe whether one of these assignments has user (auth.id)?

or thinking wrong way?

edit: more think , seek implement rule, more believe it's not possible using firebase auth rules. hope that's not case.

there's not way search children of rule match. simple reply here index users projects, either putting list of valid projects under each user (just you've done assignments) or maintaining separate list:

/users/$userid/projects/$projectid/true /project_assignments/$userid/$projectid/true

either of these allow write security rule in question:

"projects": { "$projectid": { ".read": "root.child('users/'+auth.uid+'/projects/'+$projectid).exists()" // or ".read": "root.child('project_assignments/'+auth.uid+'/'+$projectid).exists()" } }

firebase firebase-security