1

I'm trying to create the following structure:

[
    {
        name: 'tester',
        comment: 'first comment',
        comments: [
            {
                name: 'tester2',
                comment: 'reply'
            }
        ]
    }
]

I have the following security rules set up:

{
    "rules": {
        ".read": true,
        "comments": {
            "$recording": {
                "$comment": {
                    ".write": "!data.exists() && auth != null",
                    ".validate": "auth.name == newData.child('name').val() && newData.hasChildren(['name', 'comment']) && newData.child('comment').isString()",
                    "comments": {
                        "$reply": {
                            ".write": "!data.exists() && auth != null",
                            ".validate": "auth.name == newData.child('name').val() && newData.hasChildren(['name', 'comment']) && newData.child('comment').isString()"
                        }
                    }
                }
            }
        }
    }
}

But when I try to push() to the comments attribute of an existing comment, the !data.exists() in the first .write fails. Even if it wouldn't, the auth.name == newData.child('name').val() in the first .validate would fail.

So my question is: How can I selectively allow a push to an attribute while preventing changes to other attributes? In other words, can I somehow notice if I'm trying to write to /comments/1/2/3 in the .write or .validate for /comments/1/2?

1 Answer 1

1

Write rules have an "OR" relationship. You only need one to succeed to allow the write. Validate rules have an "AND" relationship -- they all need to succeed to allow the write.

I'm not sure why your example above isn't working. You should be able to push to /comments/$recording/$comment/comments/

I would suggest running this through the Rules Simulator in your Firebase Dashboard to see why your write is failing.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.