Everyone welcome back to class.
Johnny be here with slopes dot com.
And in this lesson we are going to take a look at our security rules for our thoughts.
So a couple of lessons go.
We did some some advanced security rules for our comments and now we're going to take a look at our
thoughts as well.
All right so right now we have it so that anyone as long as they are logged in can read and write thoughts.
But just like our comments now that we are able to delete.
We want to make it so that only people that own the comments can actually do the deleting.
So we're going to do is we're going to learn to make it so that anyone can read the thoughts just like
our comments but as well as create.
So here when I say allow read and create as long as you're logged in.
And right now since we're not updating we're not doing anything special with the updating I mean I'll
leave that for you.
It has a challenge in the next lesson.
I'm also going to say update here.
But for deleting we only want the people who own the thought to be able to delete that thought.
So we're going to say allow delete if we're going to say request that you write the equal to the resource
that data that user ID.
And again like we were talking about a couple of lessons ago.
All this is doing is comparing the identity of the person making the request with the stored user ID
that is inside of the data for the stored resource and firer store.
And if they match then they are allowed to perform whichever action is being specified here.
In this case delete.
So I'm going to publish this and looks like we got an error here as he was.
Let's see what's wrong.
Oh I have my if and my colon mixed up so should be allow delete colon if requests.
There go and then publish that and well wait a couple of seconds and come back when when when this is
available.
All right so to test this out.
Let's jump back into X code and let's run this.
All right so let's create a new comment or a new thought and post it.
And let's add some comments comment one at Comment two and added And let's make sure that we can still
delete it.
All right so we are still able to delete.
So our security rules seem to be working pretty good.
But let me let me show you something here.
We are going to run this on a second simulator.
Now I want to run this.
All right.
So we currently have this running on two simulators.
They are both logged in under the same account right now.
But I'm going to log out and create a new user and we'll call this one B and B looks b and b dot com
password is 1 2 3 4 5 6 years a name is Bella.
And then I create this user and then log in and be calm and 1 2 3 4 5 6 and loggin.
All right.
And I'm going to create a thought under Bela's account so Bello's thoughts post this and I'm going to
create one comment from Bellah comment from Bella I want to add that and then I'm going to add a thought
from her comment comment from J.B. And we haven't done this before.
So this is actually pretty cool being able to see the two stimulators side by side and how how they
work together you know when we add a comment over here it automatically shows up over here.
You can see that in Bela's logged in account she is able to edit and delete comments from her account
but not jeebies.
And over in Jabe's account we're able to edit and delete jobbies comments by Belus.
That's pretty cool.
All right.
So let's come back to our main screen here and now Bella is going to try and delete her thought.
OK.
So she deleted but oh we get an error here it says could not delete subcollection missing or insufficient
permissions.
So what's going on here.
You know Bella she has she has access to be able to delete her thought because we said that right here
right.
Delete if hand her you I.D. matches the resource ID of the of the thought but inside of this thought
there is a comment from J.B..
And if we take a look at our comments rules we only allow deleting if the users if the requestors I.D.
matches the resources data user ID.
And in this case Bela's user ID does not match the resource user ID for Jabe's comment.
All right so this is a problem because now we have this kind of a catch 22 where Abella wants to delete
her thought.
But G-B has a comment under there.
And Bella can delete Jabe's comment and so we're going to have to do is kind of make an executive decision
here and say well a user should be able to delete a thought and any comments associated with it if they
so desire.
And thats just a decision that we as the app owner are making.
You might handle it differently if you wanted but that's how we're going to do it.
And so what we're going to do is we're going to say we can delete a comment if the owner of the comment
is trying to delete it or if the owner of the thought that the common belongs to is trying to delete
it.
So to do that we're going to use an OR statement here which is done with two pipes going to move this
over here.
And what we're going to do is we're going to say we're going to compare the user id of the thought document
with the user id of the of the person making the request.
All right so we're going to say if the request got off that you ID is equal to.
And then we need a way to get the user id of the thought document.
All right.
And we have access to the requestors off information the requestors resource data as well as the resource
data of the document being accessed.
But we don't automatically have access to the information of a different document elsewhere to do that
we need to use a what's called a get and that is written like this.
We say get and then we have a parentheses and then what we need to do is we need to provide the full
path to to the document that we want to get.
And that actually includes this very top level path here.
So what we do is we say slash data bases slash and then this part's a little bit different when you're
using like actual documents.
We use a dollar sign and then parentheses.
And so this is database.
And then another slash for the documents and then another slash.
All right so this right here is equivalent to this right here.
OK.
So anywhere you that you see the wildcard database or the wild card and a document.
Same thing is right here.
That will then be a dollar sign and parentheses and then the the notation for it.
All right so then we come down to our thoughts level here and we're going to say thoughts collection
and then our dollar sign and our parentheses and thought and this is our path to our thought that we
need to access.
Okay.
And so this whole get right here will kind of be the same as like this resource can.
So it's getting the resource at a for a document at a specific path.
Then we can say that the data that user ID and put a space right here.
And let's just look at this one more time.
We are comparing the requestors UAD with the resource data of the thought.
But since we don't have direct access to it right now we go and get it and we do that by saying get
and providing the full path including the highest level path right here.
And then the thoughts collection and then the thought itself and then calling the data that user ID.
So let's go ahead and publish this and see if it's working now.
So it's been a couple of minutes.
Let's go and try this one more time.
I'm going to click on Bela's thought and try to delete it.
And there it goes.
All right so now that we have successfully modified our security rules to allow the deletion of a comment
if the or if the requester owns the comment or if the requester owns the thought that the common belongs
to.
All right so you know we've got some pretty complicated and thorough security rules that we've written
out here.
Like I said before there's still a lot more that you can do.
You can do a lot of stuff with their security rules but this is probably about the level that you'll
need for probably 90 percent of your apps.
So the way to go but you guys have this under your belt now.
And we're pretty much done with this with this course with the entire course with this app and we built
out a pretty impressive app and using firestorm makes it so easy.
And I love it.
But in the next lesson I'm going to extend a couple of challenges for you all to enhance and expound
on this app for yourselves.
All right.
So see you then.