title: Basic user authentication with records in AngularFire
body: <p>Having spent literally days trying the different, various recommended ways to do this, I've landed on what I think is the most simple and promising. Also thanks to the kind gents from this SO question: <a href="https://stackoverflow.com/questions/19459640/get-the-index-id-of-an-item-in-firebase-angularfire?noredirect=1#comment28889634_19459640">Get the index ID of an item in Firebase AngularFire</a></p>
  
  <p><strong>Curent setup</strong></p>
  
  <p>Users can log in with email and social networks, so when they create a record, it saves the <code>userId</code> as a sort of foreign key.</p>
  
  <p><img src="https://i.stack.imgur.com/8E1RF.png" alt="enter image description here"></p>
  
  <p>Good so far. But I want to create a rule so <code>twitter2934392</code> cannot read <code>facebook63203497</code>'s records.</p>
  
  <p>Off to the security panel</p>
  
  <p><img src="https://i.stack.imgur.com/nQXS8.png" alt="enter image description here"></p>
  
  <p><strong>Match the IDs on the backend</strong></p>
  
  <p>Unfortunately, the docs are inconsistent with the method from <a href="https://stackoverflow.com/questions/17687713/is-firebase-user-id-unique-per-provider-facebook-twitter-password">is firebase user id unique per provider (facebook, twitter, password)</a> which suggest appending the social network to the ID. The docs expect you to create a different rule for each of the login method's ids. Why anyone using >1 login method would want to do that is beyond me.</p>
  
  <p><img src="https://i.stack.imgur.com/O8TAR.png" alt="enter image description here"></p>
  
  <p>(From: <a href="https://www.firebase.com/docs/security/rule-expressions/auth.html" rel="nofollow noreferrer">https://www.firebase.com/docs/security/rule-expressions/auth.html</a>)</p>
  
  <p>So I'll try to match the concatenated <code>auth.provider</code> with <code>auth.id</code> to the record in <code>userId</code> for the respective <code>registry</code> item.</p>
  
  <p><a href="https://www.firebase.com/docs/security/rule-expressions/path.html" rel="nofollow noreferrer">According to the API</a>, this should be as easy as</p>
  
  <p><img src="https://i.stack.imgur.com/Bp0yu.png" alt="enter image description here"></p>
  
  <p>In my case using <code>$registry</code> instead of <code>$user</code> of course.</p>
  
  <pre><code>{
    "rules": {
      ".read": true,
      ".write": true,
      "registry": {
        "$registry": {
          ".read": "$registry == auth.id"
        }
      }
    }
  }
  </code></pre>
  
  <p>But that won't work, because (see the first image above), AngularFire sets each record under an index value. In the image above, it's <code>0</code>. Here's where things get complicated.</p>
  
  <p>Also, I can't test anything in the simulator, as I cannot edit <code>{some: 'json'}</code> To even authenticate. The input box rejects any input.</p>
  
  <p><img src="https://i.stack.imgur.com/zUeBv.png" alt="enter image description here"></p>
  
  <p>My best guess is the following.</p>
  
  <pre><code>{
    "rules": {
      ".write": true,
      "registry": {
        "$registry": {
          ".read": "data.child('userId').val() == (auth.provider + auth.id)"
        }
      }
    }
  }
  </code></pre>
  
  <p>Which both throws authentication errors and simultaneously grants full read access to all users. I'm losing my mind. What am I supposed to do here?</p>