How do I write a Firebase security rule where unauthenticated users can write but only my trusted server can read? - firebase-security

Question

I would like to write a rule where persons submitting a form from the webpage (unauthenticated) can .write and only the server can .read messages that are newer than two minutes old.
The server (App Engine Python-Flask instance) polls Firebase every two minutes., but I keep getting a JSON feedback {error: Permission Denied}, instead of my requested data.
The Security Rules look like this:
{
"rules": {
"leads": {
".write": true,
"$user_id": {
".write": true,
".read": "auth !== null && $user_id === auth.uid && data.child('CREATED').val() > (now - 120000)"
}
}
}
}
The simulator tells me:
Attempt to read /leads with auth={"provider":"custom","uid":"lead_checker"}
/
/leads
No .read rule allowed the operation.
Read was denied.
Can anyone spot what I am doing wrong or provide a suitable replacement?

Answer 1

When you have a clause like $user_id === auth.uid in your read rule, it says: this data can be read when the current user's uid matches the node name. So for your user lead_checker is means that it can read the node named lead_checker.
What you're probably looking to do is to allow lead_checker read access to each user node:
{
"rules": {
"leads": {
"$user_id": {
".write": true,
".read": "auth.uid == 'lead_checker'"
}
}
}
}
With this the lead checker can reach each node under leads. Note that it still can't read the leads node itself. If that is needed, move the read rule one level up:
{
"rules": {
"leads": {
".read": "auth.uid == 'lead_checker'"
"$user_id": {
".write": true,
}
}
}
}