如何使用嵌套安全规则从 Firebase 数据库获取所有资源？

发布于 2025-01-11 17:53:52 字数 1151 浏览 0 评论 0原文

在firebase中，是否可以配置规则，以便在获取父资源时，仅返回用户有权访问的子项目？

我有一个像这样的数据结构：

{
  application_access_request: {
    app_id_1: {
      access_key_1: {
        email: "[email protected]"
      },
    },
    app_id_2: {
      access_key_2: {
        email: [email protected]
      },
    }
  }
}

然后我有这样的规则：

{
  "application_access_request": {
      "$appId": {
        "$accessId": {
          ".read": "data.child($accessId).child('email').val() === auth.token.email",
        },
      }
    },
}

作为使用电子邮件登录的用户 [电子邮件受保护], 当我从 application_access_request/ 请求所有资源时，然后我希望 app_id_1 及其子项可访问/返回给用户，

是否可以允许读取所有 application_access_request 但仅返回经过身份验证的用户拥有的应用程序访问？

原文

In firebase, is it possible to configure a rule so that when a parent resource is fetched, it only returns child items that the user as access to?

I have a data structure like so:

{
  application_access_request: {
    app_id_1: {
      access_key_1: {
        email: "[email protected]"
      },
    },
    app_id_2: {
      access_key_2: {
        email: [email protected]
      },
    }
  }
}

And then I have rules like so:

{
  "application_access_request": {
      "$appId": {
        "$accessId": {
          ".read": "data.child($accessId).child('email').val() === auth.token.email",
        },
      }
    },
}

As a user logged in with email [email protected],
When I request all resources from application_access_request/,
Then I want app_id_1 and it's children to be accessable / returned to the user,

Is it possible to allow reading of all application_access_request but only return apps that the auth'd user has access to?

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

笑脸一如从前 2025-01-18 17:53:52

不可以，安全规则不能用于有选择地返回信息（请参阅规则不过滤器）。但是，您可以使用查询来解决此用例。例如，如果您的数据是结构化的：

{
  application_access_request: {
    app1: {
      access_key: "[email protected]"
    },
    app2: {
      access_key: "[email protected]"
    }
  }
}

您可以使用 query-基于规则来限制查询：

"application_access_request": {
  ".read": "auth.uid != null && auth.token.email_verified &&
            query.orderByChild == 'access_key' &&
            query.equalTo == auth.token.email"
}

No, security rules cannot be used to selectively return information (see rules are not filters). You may, however, be able to use querying to solve this use case. For example, if your data was structured:

{
  application_access_request: {
    app1: {
      access_key: "[email protected]"
    },
    app2: {
      access_key: "[email protected]"
    }
  }
}

You can use query-based rules to limit querying:

"application_access_request": {
  ".read": "auth.uid != null && auth.token.email_verified &&
            query.orderByChild == 'access_key' &&
            query.equalTo == auth.token.email"
}

回复收藏 0 原文

~没有更多了~