mercredi 21 août 2019

Firebase database rules: .exists() always true

I am trying to allow people to refer friends within a game. There is a bonus for adding multiple friends and I am trying to avoid exploitation of random user names being added. So I want to check, before they add the user to their list that the user actually exists and that the user signed up with their referal code.

Here is an example of the structure of my database:

"friends": {
    "qwerty12345": {
        "friend1": {},
        "friend2": {},
        "friend3": {},
        "friend4": {},
    }
},
"users": {
    "qwerty12345": {},
    "salamander12345": {},
    "harrypotter12345": {}
}

so, with the above structure;

When someone signups there is a friend referrer set. This is the "account uid" of the friend that referred them. What I want to do is add the current user uid as a child of friends > referring friend.

so, lets say user pikachu12345 signs up from a link sent from their friend qwerty12345. The structure will look like:

"friends": {
    "qwerty12345": {
        "pikachu12345": {},
    }
},

I only want to add to friends > qwerty12345 > pikachu12345 if that qwerty12345 exists in users.

I have this rule set up:

"friends": {
    "$user": {
      ".write": "$user === newData.child('account_uid').val() && root.child('users').child(newData.child('account_uid').val()).exists()"
    }
  },

However,when I set the referring friend to hercule12345 which does not exist in the users table. It still adds it to the friends tree.

Why is it always evaluating true?

edit, Also in case it is relevant, this is being written using a Cloud Function:

var data = {
        referred_by: "qwerty12345",
        current_user:"pikachu12345"
    }
admin.database().ref(`/friends/${data.referred_by}/${data.current_user}`).set(data)




Aucun commentaire:

Enregistrer un commentaire