How do I specify read access for known paths but disable enumeration in Firebase Database?

Question

I'd like to specify rules in Firebase such that a path can only be accessed if it's known.

/root
  /messages
    /message1
    /message2
    /message3

If you access /messages you can receive a permission denied (or nothing).

If you explicitly access /messages/message2 you get the contents.

Update 1: Expected behaviour (iOS)

FIRDatabase .database() .reference() .child("invitations") .observeEventType(.Value, withBlock: { snapshot in

// snapshot returns nothing or permission denied. })

FIRDatabase
  .database()
  .reference()
  .child("invitations/message1")
  .observeEventType(.Value, withBlock: { snapshot in

  // snapshot returns message1
})

Answer 1

This is not an answer, but I believe the OP is asking how to prevent enumeration of the nodes under a given node, while allowing anonymous access if the user knows the DIRECT path of a given node.

I too, have been trying to figure out how to do this. Basically, I'm trying to post semi-sensitive data under a given node, while making the name of the node available securely through a different means. However, I don't want to implement a "security/user" model within Firebase. I'd simply like to use Firebase similar to an Amazon S3 bucket, where if you know the location of a key, you can download the file/data stored at that location, while still preventing enumeration/listing of the nodes within the database.

An example of such usage would be if you generate the keyname using a crypto digest such as SHA2. The key couldn't be easily generated, yet if you knew the key, you could access the node directly. Does anyone know how to do this?

EDIT: I figured out how to do this in Firebase. The solution is rather simple. Here is an example of the JSON security rules in Firebase:

{
    "rules": {
        "users" : {
          ".read": false,
          ".write": false,
          "$child" : {
            ".read" : true,
            ".write" : true
          }
        },
        "chats" : {
          ".read" : false,
          ".write" : false,
          "$child" : {
            ".read" : true,
            ".write" : true,
          },
        },
        "comments" : {
          ".read" : false,
          ".write" : false,
          "$child" : {
            ".read" : true,
            ".write" : true
          },
        },
        ".read": false,
        ".write": false
    }
}

In this example, any node under "users", "chats", and "comments" is directly accessible, but enumeration is no longer possible.