Firestore User Collection isAdmin implementation Angular

Question

I'm trying to create an admin interface for the web application I'm developing. I'm using Angular with Angularfire2. I'm using Firebase Firestore as the database.

I wanted to see how we can implement an isAdmin flag in the users collection so that specified users can access admin features.

Can anyone shed some light on how I can approach to develop this. I know there are security rules you can set on the users document. If authenticated users are allowed to read and write to their own doc, what's stopping them from changing the isAdmin flag?

Or is this really as simple as adding a boolean key and toggling that in the admin interface?

Thanks, Walter

Jen Person · Accepted Answer · 2017-12-01 21:30:26Z

4

You can use custom auth claims from a custom server using the Firebase Admin SDK. Then you can incorporate these claims into your Firestore security rules rules. You can find out more about controlling access with custom claims here. In your Firestore rules, for example, you could limit read access to this document using the admin custom claim like this:

service cloud.firestore {
  match /databases/{database}/documents/adminContent {
    allow read: if request.auth.token.admin == true;
  }
}

Which could be set from a custom server or Cloud Functions for Firebase like this:

// Set admin privilege on the user corresponding to uid.
admin.auth().setCustomUserClaims(uid, {admin: true}).then(() => {
  // The new custom claims will propagate to the user's ID token the
  // next time a new one is issued.
});

answered Dec 1, 2017 at 21:30

Jen Person

7,57626 silver badges31 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

wdumlao Over a year ago

Wow Jen! Thanks for responding a big fan btw. This is very cool. I never even heard of this and it should do everything I need even roles outside of just admins.

tree em Over a year ago

can you more explain this phrase // The new custom claims will propagate to the user's ID token the // next time a new one is issued.

Jen Person Over a year ago

I recommend you check out the link I included for further details, but that means the next time the user's auth token is refreshed (manually in code or by signing out and in again) the user's token will include the custom claim.

Collectives™ on Stack Overflow

Firestore User Collection isAdmin implementation Angular

1 Answer 1

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related