north-star / commit
added info about firebase, including the current rules
database.rules.json | 17 +++++++++++++++++ readme.md | 13 +++++++++++++ 2 files changed, 30 insertions(+) diff --git a/database.rules.json b/database.rules.json new file mode 100644 index 0000000..923735a --- /dev/null +++ b/database.rules.json @@ -0,0 +1,17 @@ +{ + "rules": { + ".read": false, + ".write": false, + "rooms": { + "$roomId": { + ".read": "auth != null && $roomId.matches(/^[a-z0-9]{8}$/)", + "participants": { + "$uid": { + ".write": "auth != null && auth.uid === $uid", + ".validate": "!newData.exists() || (newData.hasChildren(['encryptedState']) && newData.child('encryptedState').isString() && newData.child('encryptedState').val().length > 0 && !newData.child('id').exists() && !newData.child('name').exists() && !newData.child('color').exists() && !newData.child('position').exists() && !newData.child('timestamp').exists()) || (newData.hasChildren(['id','name','color','position','timestamp']) && newData.child('id').isString() && newData.child('id').val() === auth.uid && newData.child('name').isString() && newData.child('name').val().length > 0 && newData.child('name').val().length <= 32 && newData.child('color').isString() && newData.child('color').val().matches(/^#[0-9a-fA-F]{6}$/) && newData.child('position').hasChildren(['lat','lon']) && newData.child('position/lat').isNumber() && newData.child('position/lon').isNumber() && newData.child('timestamp').isNumber())" + } + } + } + } + } +} diff --git a/readme.md b/readme.md index 7eb38df..3b2292e 100644 --- a/readme.md +++ b/readme.md @@ -17,6 +17,19 @@ North Star is a web application that allows users to share their location in rea The app uses Firebase Realtime Database to store and sync the location data of all participants in real-time. When a user joins a room, they are added to the database with their location and other information. The app listens for changes in the database and updates the map accordingly. +## Firebase database rules + +This repo includes Realtime Database security rules in [database.rules.json](database.rules.json). + +Before sharing the app publicly, add these rules in Firebase Console: + +0. https://console.firebase.google.com/project/north-star-e5dee/overview is the project used for the public instance of the app. You can create your own Firebase project and use it instead. +1. Open Firebase Console -> your project -> Realtime Database -> Rules. +2. Replace the current rules with the contents of [database.rules.json](database.rules.json). +3. Publish the rules. + +Without these rules, your database may allow unsafe writes. + ## Is it secure? The app does not require any authentication, so anyone with the room link can join and see the location of all participants.