Role-based access control pattern in Firebase - Mini Project: Build & Apply

Role-based access control pattern

📖 Scenario: You are building a simple Firebase app where users have different roles: admin, editor, and viewer. Each role has specific permissions to read or write data in the Firestore database.We want to create a role-based access control (RBAC) pattern using Firebase Security Rules to protect the data.

🎯 Goal: Build Firebase Security Rules that allow:admins to read and write all documents in the posts collection.editors to read all documents and write only their own documents in posts.viewers to only read documents in posts.

📋 What You'll Learn

Create a Firestore collection named posts.

Use Firebase Authentication to identify users and their roles stored in request.auth.token.role.

Write security rules that enforce the RBAC pattern described.

Ensure editors can only write documents where the ownerId field matches their user ID.

💡 Why This Matters

🌍 Real World

Role-based access control is essential in apps to protect data and ensure users only do what they are allowed to do.

💼 Career

Understanding Firebase Security Rules and RBAC is important for cloud developers and security engineers working with Firebase backend.

1

Define the Firestore posts collection structure

Create a Firestore collection named posts where each document has fields title (string), content (string), and ownerId (string). Write the Firestore document example in JSON format assigned to a variable called postExample.

Firebase

# Define a Firestore document example for the posts collection
# Your code here

Hint

Use a dictionary with keys title, content, and ownerId with string values.

2

Create a variable for user role from authentication token

Create a variable called userRole that extracts the user's role from request.auth.token.role in the Firebase Security Rules syntax.

Firebase

postExample = {
    "title": "Welcome to Firebase",
    "content": "This is the first post.",
    "ownerId": "user_123"
}

// Define userRole variable from request.auth.token.role
// Your code here

Hint

Assign userRole to request.auth.token.role exactly.

3

Write the core RBAC logic for read and write permissions

Write the main Firebase Security Rules expressions for allow read and allow write on the posts collection. Use userRole to allow:
- admins to read and write all documents,
- editors to read all documents and write only if resource.data.ownerId == request.auth.uid,
- viewers to only read documents.
Use the exact syntax: allow read: if ...; and allow write: if ...;

Firebase

postExample = {
    "title": "Welcome to Firebase",
    "content": "This is the first post.",
    "ownerId": "user_123"
}

userRole = request.auth.token.role

// Write allow read and allow write rules for posts collection
// Your code here

Hint

Use in to check roles for read. For write, check if userRole is admin or editor with ownership.

4

Complete the Firebase Security Rules for the posts collection

Wrap the previous logic inside a match /databases/{database}/documents/posts/{postId} block and a rules_version = '2'; header. Include the service cloud.firestore declaration. Write the full Firebase Security Rules code.

Firebase

// Add full Firebase Security Rules with service, rules_version, and match block
// Your code here

Hint

Use a function userRole() inside the match block to return request.auth.token.role. Wrap rules inside service cloud.firestore and match blocks.

Practice

1. What is the main purpose of role-based access control (RBAC) in Firebase security rules?

easy

A. To store user data in Firestore

B. To manage user permissions based on their assigned roles

C. To create user authentication tokens

D. To automatically backup database data

Solution

1. Step 1: Understand RBAC concept

   RBAC assigns permissions to users based on their roles, controlling what they can access.

2. Step 2: Identify RBAC purpose in Firebase

   In Firebase, RBAC is used in security rules to allow or deny access depending on user roles.

3. Final Answer:

   To manage user permissions based on their assigned roles -> Option B

4. Quick Check:

   RBAC controls permissions by roles [OK]

Hint: RBAC controls access by user roles, not data storage [OK]

Common Mistakes:

• Confusing RBAC with data storage functions
• Thinking RBAC creates authentication tokens
• Assuming RBAC handles backups

2. Which Firebase security rule syntax correctly checks if a user has the role 'admin' using request.auth.token.role?

easy

A. allow read: if request.auth.token.role == 'admin';

B. allow read: if request.auth.role == 'admin';

C. allow read: if auth.token.role == 'admin';

D. allow read: if request.auth.token == 'admin';

Solution

1. Step 1: Identify correct token path

   The user's role is stored in request.auth.token.role, so the check must use this exact path.

2. Step 2: Match syntax for role check

   The correct syntax compares request.auth.token.role to the string 'admin' using ==.

3. Final Answer:

   allow read: if request.auth.token.role == 'admin'; -> Option A

4. Quick Check:

   Use full path request.auth.token.role == 'admin' [OK]

Hint: Use full path request.auth.token.role for role checks [OK]

Common Mistakes:

• Using request.auth.role instead of request.auth.token.role
• Omitting 'token' in the path
• Comparing token object directly to string

3. Given this Firebase rule snippet:

allow write: if request.auth.token.role == 'editor';

What happens if a user with role 'viewer' tries to write data?

medium

A. The write is allowed because the user is authenticated

B. The write is allowed only if the user has a custom claim

C. The write is denied because the role is not 'editor'

D. The write is denied because the token is missing

Solution

1. Step 1: Analyze the rule condition

   The rule allows write only if request.auth.token.role equals 'editor'.

2. Step 2: Check user's role against condition

   The user has role 'viewer', which does not match 'editor', so the condition fails.

3. Final Answer:

   The write is denied because the role is not 'editor' -> Option C

4. Quick Check:

   Role mismatch denies write [OK]

Hint: Role must exactly match to allow access [OK]

Common Mistakes:

• Assuming any authenticated user can write
• Confusing roles with authentication status
• Ignoring role check in rules

4. Identify the error in this Firebase security rule snippet:

allow read: if request.auth.token.role = 'admin';

medium

A. Using single equals '=' instead of double equals '==' for comparison

B. Missing semicolon at the end of the statement

C. Incorrect property name; should be request.auth.role

D. Using 'allow read' instead of 'allow write'

Solution

1. Step 1: Check comparison operator

   The rule uses '=' which is an assignment operator, not a comparison operator.

2. Step 2: Correct operator for equality check

   Firebase rules require '==' to compare values, so '=' causes a syntax error.

3. Final Answer:

   Using single equals '=' instead of double equals '==' for comparison -> Option A

4. Quick Check:

   Use '==' for comparisons in rules [OK]

Hint: Use '==' for comparisons, '=' is assignment [OK]

Common Mistakes:

• Using '=' instead of '==' in conditions
• Confusing property names in request.auth
• Ignoring syntax errors in rules

5. You want to allow users with roles 'admin' or 'moderator' to delete documents, but only 'admin' can update them. Which Firebase rule snippet correctly implements this?

hard

A. allow delete: if request.auth.token.role == 'admin' || 'moderator';
allow update: if request.auth.token.role == 'admin';

B. allow delete, update: if request.auth.token.role == 'admin' || 'moderator';

C. allow delete: if request.auth.token.role == 'admin' && request.auth.token.role == 'moderator';
allow update: if request.auth.token.role == 'admin';

D. allow delete: if request.auth.token.role in ['admin', 'moderator'];
allow update: if request.auth.token.role == 'admin';

Solution

1. Step 1: Understand role conditions for delete

   Users with role 'admin' or 'moderator' can delete, so use 'in' operator with list ['admin', 'moderator'] for clarity and correctness.

2. Step 2: Understand role condition for update

   Only 'admin' can update, so check equality with 'admin' for update permission.

3. Step 3: Evaluate options

   allow delete: if request.auth.token.role == 'admin' || 'moderator'; allow update: if request.auth.token.role == 'admin'; has syntax error ('|| 'moderator'' invalid); allow delete, update: if request.auth.token.role == 'admin' || 'moderator'; has syntax error with '|| 'moderator''; allow delete: if request.auth.token.role == 'admin' && request.auth.token.role == 'moderator'; allow update: if request.auth.token.role == 'admin'; uses '&&' which requires both roles simultaneously (impossible). allow delete: if request.auth.token.role in ['admin', 'moderator']; allow update: if request.auth.token.role == 'admin'; correctly uses 'in' and separate rules.

4. Final Answer:

   allow delete: if request.auth.token.role in ['admin', 'moderator']; allow update: if request.auth.token.role == 'admin'; -> Option D

5. Quick Check:

   Use 'in' for multiple roles, '==' for single role [OK]

Hint: Use 'in' for multiple roles, '==' for single role check [OK]

Common Mistakes:

• Using '&&' instead of '||' for multiple roles
• Incorrect syntax with '||' and strings
• Trying to check multiple roles with '==' operator