How to programmatically modify security rules in Firebase?

Question

The examples in the firebase documents assume manual update of firebase security rules. How can security rules be modified programmatically to support real-world collaborative applications? In the use case that I am considering, the requirement is for a user to be able to invite other users to collaborate/share selected data and to be able to grant/revoke access to the collaborators. How can this be accomplished with firebase?

Answer 1

You actually shouldn't programmatically change your security rules. You should think of them as code and only change them at deploy time.

If what you're trying to do is change what users are actually allowed to do, you should do this by writing security rules that depend on data in your Firebase.

For example, lets say you wanted to restrict access to a piece of data to only users in a specific group. Rather than modifying the security rules everytime the group membership changed, you would simply store the group in Firebase and have your security rules check to see if the current user is in that group before allowing access.

".read" : "root.child('groups').child($groupID).child(auth.userid).exists()"

That way, anytime group membership changes, users will automatically be granted access to the data they should be allowed to see.

For a more complex example of security rules, take a look at the rules.json file in Firefeed.