Search code examples
firebasefirebase-realtime-databasefirebase-security

What is the purpose of the .validate line in this Firebase Realtime Database security rule?


In this example rule for the members node, this node is going to be filled with UIDs. So why would the incoming data have children username and email that this rule is checking? Does this rule ensure that UID, username, and email are all written into the node?

"rules": {
  ///...
  "members": {
      "$uid": {
        ".write": "root.child('groups/groupID/admin').val() === auth.uid",
        ".validate": "newData.hasChildren(['username', 'email'])", /// ???
        "$other": {
          ".write": "auth.uid === $uid && auth.uid === $other",
        }
      }
    }
}

Solution

  • The key if those node is $uid, but it has to have username and email child nodes. This is a common way to ensure that the node will always have at least those properties.