Temporary Variables in Firebase Security rules

Question

So I'm setting up the firebase security rules for my project and for the user to have read access to a room, we need to make sure they are part of that organization. So I have a security rule like this:

root.child('organizations').child(data.child('organization_id').val()).child('user_ids').hasChild(auth.uid)

Not only is this really ugly, there are several other rules in the same statement (separated by &&/||) which have start with root.child('organizations').child(data.child('organization_id').val()) to access data from the organization variable associated with this room.

This leads to some UGLY security rules, is there any way I can make temporary variables or something like that so I can make this a lot more readable? Thank you!

Answer 1

Nope. The Firebase Security rules language doesn't have support for custom variables. This indeed leads to lots of duplication between rules.

The best solution is to write your rules in a higher-level language, that compiles into Firebase Security rules. The most well-known ones are Blaze (the grand-daddy of them all), Butane (not from Firebase itself) and Bolt (new and under very active development).

Bolt for example allows you to define (global) functions, which can easily encapsulate the repeated snippet and much more.