Role-based access control pattern in Firebase - Step-by-Step Execution

Process Flow - Role-based access control pattern

User tries to access resource

↓

Check user's role

↓

Role allowed?

↓

Grant access

↓

Access result

User requests access, system checks their role, then grants or denies access based on allowed roles.

Execution Sample

Firebase

match /documents/{docId} {
  allow read: if request.auth.token.role == 'admin';
  allow write: if request.auth.token.role == 'editor';
}

This Firebase rule allows reading only if the user role is 'admin' and writing only if the role is 'editor'.

Process Table

Step	User Role	Requested Action	Condition Checked	Access Result
1	admin	read	role == 'admin'	Access granted
2	admin	write	role == 'editor'	Access denied
3	editor	read	role == 'admin'	Access denied
4	editor	write	role == 'editor'	Access granted
5	viewer	read	role == 'admin'	Access denied
6	viewer	write	role == 'editor'	Access denied

💡 Access is granted only when the user's role matches the required role for the action.

Status Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	After Step 4	After Step 5	After Step 6
request.auth.token.role	undefined	admin	admin	editor	editor	viewer	viewer
requested_action	undefined	read	write	read	write	read	write
access_granted	false	true	false	false	true	false	false

Key Moments - 3 Insights

Why does an 'admin' user get denied write access in step 2?

Because the write permission requires the role to be 'editor', and the user's role is 'admin' (see execution_table step 2).

Can a 'viewer' user read documents according to these rules?

No, because read access is only allowed for 'admin' role, so 'viewer' role is denied (see execution_table steps 5 and 6).

What happens if the user's role is missing or undefined?

Access will be denied since the role check conditions will fail, ensuring no access without a valid role.

Visual Quiz - 3 Questions

Look at the execution table, what is the access result for an 'editor' trying to read?

A Access pending

B Access granted

C Access denied

D Role not found

💡 Hint

Check execution_table row 3 under 'Access Result' column.

At which step does the condition 'role == "editor"' evaluate to true?

A Step 1

B Step 4

C Step 2

D Step 5

💡 Hint

Look at execution_table rows where 'Condition Checked' is 'role == "editor"' and see when access is granted.

If we add a new role 'viewer' with read access, how would step 5 change?

A Access granted for read

B Access denied for read

C Access granted for write

D No change

💡 Hint

Consider how adding 'viewer' role to read permission affects access in execution_table step 5.

Concept Snapshot

Role-based access control (RBAC) uses user roles to allow or deny access.
In Firebase, rules check request.auth.token.role.
Access is granted only if the user's role matches the required role.
Separate rules can control read and write permissions.
If role is missing or mismatched, access is denied.

Full Transcript

This visual execution shows how role-based access control works in Firebase security rules. When a user requests access to a document, the system checks their role from the authentication token. If the role matches the required role for the requested action (read or write), access is granted. Otherwise, access is denied. For example, only users with the 'admin' role can read, and only users with the 'editor' role can write. Users with other roles like 'viewer' are denied both read and write access. This pattern ensures that users only perform actions allowed by their roles, improving security and control.

Practice

1. What is the main purpose of role-based access control (RBAC) in Firebase security rules?

easy

A. To store user data in Firestore

B. To manage user permissions based on their assigned roles

C. To create user authentication tokens

D. To automatically backup database data

Solution

1. Step 1: Understand RBAC concept

   RBAC assigns permissions to users based on their roles, controlling what they can access.

2. Step 2: Identify RBAC purpose in Firebase

   In Firebase, RBAC is used in security rules to allow or deny access depending on user roles.

3. Final Answer:

   To manage user permissions based on their assigned roles -> Option B

4. Quick Check:

   RBAC controls permissions by roles [OK]

Hint: RBAC controls access by user roles, not data storage [OK]

Common Mistakes:

• Confusing RBAC with data storage functions
• Thinking RBAC creates authentication tokens
• Assuming RBAC handles backups

2. Which Firebase security rule syntax correctly checks if a user has the role 'admin' using request.auth.token.role?

easy

A. allow read: if request.auth.token.role == 'admin';

B. allow read: if request.auth.role == 'admin';

C. allow read: if auth.token.role == 'admin';

D. allow read: if request.auth.token == 'admin';

Solution

1. Step 1: Identify correct token path

   The user's role is stored in request.auth.token.role, so the check must use this exact path.

2. Step 2: Match syntax for role check

   The correct syntax compares request.auth.token.role to the string 'admin' using ==.

3. Final Answer:

   allow read: if request.auth.token.role == 'admin'; -> Option A

4. Quick Check:

   Use full path request.auth.token.role == 'admin' [OK]

Hint: Use full path request.auth.token.role for role checks [OK]

Common Mistakes:

• Using request.auth.role instead of request.auth.token.role
• Omitting 'token' in the path
• Comparing token object directly to string

3. Given this Firebase rule snippet:

allow write: if request.auth.token.role == 'editor';

What happens if a user with role 'viewer' tries to write data?

medium

A. The write is allowed because the user is authenticated

B. The write is allowed only if the user has a custom claim

C. The write is denied because the role is not 'editor'

D. The write is denied because the token is missing

Solution

1. Step 1: Analyze the rule condition

   The rule allows write only if request.auth.token.role equals 'editor'.

2. Step 2: Check user's role against condition

   The user has role 'viewer', which does not match 'editor', so the condition fails.

3. Final Answer:

   The write is denied because the role is not 'editor' -> Option C

4. Quick Check:

   Role mismatch denies write [OK]

Hint: Role must exactly match to allow access [OK]

Common Mistakes:

• Assuming any authenticated user can write
• Confusing roles with authentication status
• Ignoring role check in rules

4. Identify the error in this Firebase security rule snippet:

allow read: if request.auth.token.role = 'admin';

medium

A. Using single equals '=' instead of double equals '==' for comparison

B. Missing semicolon at the end of the statement

C. Incorrect property name; should be request.auth.role

D. Using 'allow read' instead of 'allow write'

Solution

1. Step 1: Check comparison operator

   The rule uses '=' which is an assignment operator, not a comparison operator.

2. Step 2: Correct operator for equality check

   Firebase rules require '==' to compare values, so '=' causes a syntax error.

3. Final Answer:

   Using single equals '=' instead of double equals '==' for comparison -> Option A

4. Quick Check:

   Use '==' for comparisons in rules [OK]

Hint: Use '==' for comparisons, '=' is assignment [OK]

Common Mistakes:

• Using '=' instead of '==' in conditions
• Confusing property names in request.auth
• Ignoring syntax errors in rules

5. You want to allow users with roles 'admin' or 'moderator' to delete documents, but only 'admin' can update them. Which Firebase rule snippet correctly implements this?

hard

A. allow delete: if request.auth.token.role == 'admin' || 'moderator';
allow update: if request.auth.token.role == 'admin';

B. allow delete, update: if request.auth.token.role == 'admin' || 'moderator';

C. allow delete: if request.auth.token.role == 'admin' && request.auth.token.role == 'moderator';
allow update: if request.auth.token.role == 'admin';

D. allow delete: if request.auth.token.role in ['admin', 'moderator'];
allow update: if request.auth.token.role == 'admin';

Solution

1. Step 1: Understand role conditions for delete

   Users with role 'admin' or 'moderator' can delete, so use 'in' operator with list ['admin', 'moderator'] for clarity and correctness.

2. Step 2: Understand role condition for update

   Only 'admin' can update, so check equality with 'admin' for update permission.

3. Step 3: Evaluate options

   allow delete: if request.auth.token.role == 'admin' || 'moderator'; allow update: if request.auth.token.role == 'admin'; has syntax error ('|| 'moderator'' invalid); allow delete, update: if request.auth.token.role == 'admin' || 'moderator'; has syntax error with '|| 'moderator''; allow delete: if request.auth.token.role == 'admin' && request.auth.token.role == 'moderator'; allow update: if request.auth.token.role == 'admin'; uses '&&' which requires both roles simultaneously (impossible). allow delete: if request.auth.token.role in ['admin', 'moderator']; allow update: if request.auth.token.role == 'admin'; correctly uses 'in' and separate rules.

4. Final Answer:

   allow delete: if request.auth.token.role in ['admin', 'moderator']; allow update: if request.auth.token.role == 'admin'; -> Option D

5. Quick Check:

   Use 'in' for multiple roles, '==' for single role [OK]

Hint: Use 'in' for multiple roles, '==' for single role check [OK]

Common Mistakes:

• Using '&&' instead of '||' for multiple roles
• Incorrect syntax with '||' and strings
• Trying to check multiple roles with '==' operator