title: Firebase Security Rules For A Node with Multiple Children
body: <p>My current firebase structure looks like the following </p>
  
  <p><a href="https://i.stack.imgur.com/dO9ZO.jpg" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/dO9ZO.jpg" alt="firebase"></a></p>
  
  <p>Originally, my security looks like</p>
  
  <pre><code>{
      "rules": {
          "users": {
              "$companyId": {
                  "$userId": {
                      ".read": "auth != null",
                      ".write": "auth != null",
                  }
              }
          }
      }
  }
  </code></pre>
  
  <p>This is all fine as I can simply get the user detail via </p>
  
  <pre><code>// get user information from database
  getUserInformation(companyId: string, uid: string) {
      let path = '/users/' + companyId + '/' + uid;
      return this.af.database.object(path, { preserveSnapshot: true })
  }
  </code></pre>
  
  <p>However, I want to add more security to this branch such that the user can not update the code in the front end to modify some of these entries via write operation (Read is OK).
  I want to have the user the ability to modify these entries based on the isAdmin flag 
  For example, </p>
  
  <ol>
  <li>companyId (read: auth != null, write: isAdmin == true)</li>
  <li>companyName  (read: auth != null, write: isAdmin == true)</li>
  <li>dailySubmissionLimit  (read: auth != null, write: isAdmin == true)</li>
  <li>defaultApproverEmail  (read: auth != null, write: isAdmin == true)</li>
  <li>email  (read: auth != null, write: isAdmin == true)</li>
  <li>firstName  (read: auth != null, write: isAdmin == true)</li>
  <li>id  (read: auth != null, write: isAdmin == true)</li>
  <li>isAccountActive  (read: auth != null, write: isAdmin == true)</li>
  <li>isAdmin  (read: auth != null, write: false)</li>
  <li>isPasswordOutdated  (read: auth != null, write: auth!=null)</li>
  <li>lastLoggedIn  (read: auth != null, write: auth!=null)</li>
  <li>lastName  (read: auth != null, write: isAdmin == true)</li>
  <li>passwordChangeDate_epoch  (read: auth != null, write: auth!=null)</li>
  <li>registerationDate  (read: auth != null, write: isAdmin == true)</li>
  <li>team  (read: auth != null, write: isAdmin == true)</li>
  <li>userDefaults  (read: auth != null, write: auth!=null)</li>
  </ol>
  
  <p>Since all read = auth != null.. Initially, I thought since I am able to read all the node, I could set the security individual rule for each node as shown below</p>
  
  <pre><code>{
      "rules": {
          "users": {
              "$companyId": {
                  "$userId": {
                      "companyId": {
                          ".read": "auth != null",
                          ".write": "(auth != null) &amp;&amp; (root.child('users').child($companyId).child(auth.uid).child('isAdmin').val() == true)"
                      },
                      "isAdmin": {
                          ".read": "auth != null",
                          ".write": "false"
                      },
                      "lastLoggedIn": {
                          ".read": "auth != null",
                          ".write": "auth != null"
                      },
                      ...
                  }
              }
          }
      }
  }
  </code></pre>
  
  <p>This however failed when I try to getUserInformation() because I am querying '/users/' + companyId + '/' + uid and the security rule for that particular branch is unknown</p>
  
  <p>I am guessing as an alternative, I could query each node instead '/users/' + companyId + '/' + uid + '/companyId' and combine the data using forkJoin or some sort.
  This would be highly ineffecient as I am now calling the database nth time instead of one time.</p>
  
  <p>Another approach that I can think of is to structure the data abit differently by categorising them into three branches "userCanModify", "adminCanModify", "noOnCanModify". Then set security rule for these three nodes as required.
  But this seems more like a hack to me as I have to re-structure my data to a very odd format. Also, I will still have to make three request to get the full picture of the user detail</p>
  
  <pre><code>{
      "rules": {
          "users": {
              "$companyId": {
                  "$userId": {
                      "userCanModify": {
                          "lastLoggedIn": {
                              ".read": "auth != null",
                              ".write": "auth != null"
                          },
                          ...
                      }, 
                      "adminCanModify": {
                          "companyId": {
                              ".read": "auth != null",
                              ".write": "(auth != null) &amp;&amp; (root.child('users').child($companyId).child(auth.uid).child('isAdmin').val() == true)"
                          }, 
                          "companyName": {
                              ".read": "auth != null",
                              ".write": "(auth != null) &amp;&amp; (root.child('users').child($companyId).child(auth.uid).child('isAdmin').val() == true)"
                          },
                          ...
                      }, 
                      "noOneCanModify": {
                          "isAdmin": {
                              "read": true, 
                              "write": false
                          },
                          ...
                      }
                  }
              }
          }
      }
  }
  </code></pre>
  
  <p>Is there a much better solution out there that I am missing?</p>