Firebase Security rules for an app with multiple chat rooms -

i having trouble imagining security rules application looks this:

• one firebase multiple chatrooms.
• a moderator authenticates via separate php application.
• moderators have permission modify own chat room, can read, write, update, , delete within chat room.
• guests arrive , authenticate via separate php application.
• guests have read , write access, may not delete anything.

my questions right these:

1. is possible configure rules meet these requirements? or there requirements cannot possibly met?

2. to extent php server have communicate firebase, in notifying firebase of existence of users?

first of all, check out gist, example worked time ago multiple chat rooms.

1. yes. it's possible.
2. php server? don't need no server! :)

the data structure follows:

# chats equal "rooms" /chats/chat_id/users/...  # timestamp of when each participant last viewed room /chats/chat_id/last/...   # messages sent /chats/chat_id/messages/... 

the security rules self documenting. here's local copy referential integrity.

{   "chat": {      // list of chats may not listed (no .read permissions here)       // chat conversation      "$key": {           // if chat hasn't been created yet, allow read there way           // check , create it; if exists, authenticated           // user (specified auth.account) must in $key/users         ".read": "auth != null && (!data.exists() || data.child('users').haschild(auth.account))",          // list of users authorized participate in chat         "users": {            // if list doesn't exist, can create            // if exists, users in list may modify            ".write": "!data.exists() || data.haschild(auth.account)",            "$acc": {               // value 1, later read/write/super privilege               ".validate": "newdata.isnumber()"            }         },          // timestamps recording last time each user has read chat         "last": {            "$acc": {               // may written authenticated user , if user in $key/users               ".write": "$acc === auth.account && root.child('chat/'+$key+'/users').haschild($acc)",               ".validate": "newdata.isnumber()"            }         },          "messages": {            "$msg": {               // write message, must have 3 fields (usr, ts, , msg)               // , person writing must in $key/users               ".write": "root.child('chat/'+$key+'/users').haschild(auth.account)",               ".validate":"newdata.haschildren(['ts', 'usr', 'msg'])",               "usr": {                  // may create messages myself                  ".validate": "newdata.val() === auth.account"               },               "msg": {                  ".validate": "newdata.isstring()"               },               "ts": {                  ".validate": "newdata.isnumber()"               }            }         }      }   }  } 

a moderator authenticates via separate php application. use custom login module create firebase token admins. apply security rules according data store in token.

moderators have permission modify own chat room... should pretty self explanatory extending user permissions above.

guests arrive , authenticate via separate php application. use custom login module create firebase token admins. apply security rules according data store in token.

(or scrap php app , use firebase's baked in authentication!)

guests have read , write access, may not delete anything. use newdata.exists() or newdata.haschildren(...) inside ".write" rule prevent deletion.

guests cannot spoof other guests. authentication tokens prevent this