Role-based access control pattern in Firebase - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to define a user role in Firebase rules.

Firebase

match /users/{userId} {
  allow read: if request.auth.token.role == [1];
}

Drag options to blanks, or click blank then click option'

A"admin"

B"user"

C"guest"

D"editor"

Attempts:

3 left

💡 Hint

Common Mistakes

Using role names without quotes

Using a role that is not defined in the system

The role "admin" is used here to allow read access only to admin users.

2fill in blank

medium

Complete the code to check if the user has the editor role.

Firebase

allow write: if request.auth.token.role == [1];

Drag options to blanks, or click blank then click option'

A"admin"

B"editor"

C"user"

D"guest"

Attempts:

3 left

💡 Hint

Common Mistakes

Using the wrong role for write access

Forgetting to use quotes around the role

The write permission is granted only if the user's role is "editor".

3fill in blank

hard

Fix the error in the role check to allow only admins to delete.

Firebase

allow delete: if request.auth.token.role == [1];

Drag options to blanks, or click blank then click option'

A"admin"

B"guest"

C"user"

D"editor"

Attempts:

3 left

💡 Hint

Common Mistakes

Using single '=' instead of '==' for comparison

Using the wrong role string

The equality check must use '==' instead of '=' to compare roles.

4fill in blank

hard

Fill both blanks to allow read for admins and editors only.

Firebase

allow read: if request.auth.token.role == [1] || request.auth.token.role == [2];

Drag options to blanks, or click blank then click option'

A"admin"

B"user"

C"editor"

D"guest"

Attempts:

3 left

💡 Hint

Common Mistakes

Using roles that should not have read access

Using '&&' instead of '||' for this condition

This rule allows read access if the user role is either "admin" or "editor".

5fill in blank

hard

Fill all three blanks to allow write only if user is admin and the document owner.

Firebase

allow write: if request.auth.token.role == [1] && resource.data.ownerId == [2] && request.auth.uid == [3];

Drag options to blanks, or click blank then click option'

A"admin"

Bresource.data.ownerId

Crequest.auth.uid

D"user"

Attempts:

3 left

💡 Hint

Common Mistakes

Not checking ownership correctly

Using wrong role or variables

This rule ensures that only admins who own the document can write to it.