Clash Royale CLAN TAG#URR8PPP

Firestore - security rules for users within companies

Our current Firestore structure is as follows:

My 1st question is how we can specify security rules defined by this database? Is there some best practice approach?

Our first idea was to do this:

match /databases/database/documents/projects/projectUid/document=**
allow read: if
(/databases/$(database)/documents/projects/$(projectUid)/companyId) ===
(/databases/$(database)/documents/users/$(request.auth.uid)/companyId)



But according to the documentation this would mean that we would have for each read basically 3 reads (2 queries for security and 1 real read from DB). This seems like a waste of queries.

Is there a better approach than this?
We were thinking about changing to subcollections:

This way we can use similar approach as from the doc, where each match would contain companyId and in allow statement we would use something like

match /databases/database/documents/companies/companyId/projects/projectId
allow read: if
exists(/databases/$(database)/documents/companies/$(companyId)/users/$(request.auth.uid));



Thanks for any recommendations on how to build it in the most scalable and especially most secure way.

2 Answers
2

Have you considered adding a user's company ID as a custom claim to their profile? That way no additional reads are needed in your security rules.

Since setting these claims requires the Admin SDK, it will require that you can run trusted code somewhere. But if you don't have your own trusted environment yet, you could use Cloud Functions for that e.g. based on some other action like writes to your current Firestore structure.

Adding an answer to Frank.

Borrowing from other API SDKs such as microsoft graph, typically to make a resource request you start by initializing a Client object with an authentication token representing the scope/rights of the user. For example:

const client = new SDKClient(my_auth_token);


The client constructor would have a token validation step on claims. You can then make REST calls such as

const response = await client.someEndpoint( method: 'POST', body: my_object );


I suggest rather than using the admin SDK for read/write to your firestore, you use the regular firebase nodejs client. To restrict access with security rules, pass a firebase JWT token into this custom SDKClient class with the token that you obtain from the header of your requests. In the constructor, initialize a new firebase 'app'. Because a regular firebase client is

subject to security rules, this will do what you're looking for.
Some example code has already been offered in this answer.

SDKClient

I should add that according to this firebase doc there is a 'warning' to use the admin-sdk server-side, but I'm not sure I see why.

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.