相关疑难解决方法(0)

我正在编写一个应用程序,允许用户提交在向其他用户显示之前进行审核的提名.这需要一些限制,到目前为止我没有成功实施安全规则:

1. 隐藏尚未批准的任何提名
2. 隐藏提交中的私人字段(电话,审批状态,创建日期等)

我目前的规则如下:

{
    "rules": {
        "nominations": {
            ".read": true,

            "$nominationId": {
                ".read": "data.child('state').val() == 'approved' || auth != null", // Only read approved nominations if not authenticated
                ".write": "!data.exists()", // Only allow new nominations to be created

                "phone": {
                    ".read": "auth != null" // Only allow authenticated users to read phone number
                },

                "state": {
                    ".read": "auth != null", // Only allow authenticated users to read approval state
                    ".write": "auth != null" // Only allow authenticated users to …