0Pricing
Firebase Auth & Realtime Database Apps · 课时

对用户数据进行基于角色的访问控制

结合 Firebase Auth 角色与 Realtime Database 规则，为管理员、成员和访客授予不同级别的共享数据和个人数据访问权限。

对用户数据进行基于角色的访问控制 是 CoddyKit 上的免费 Firebase Auth & Realtime Database Apps 课时。 这是第 4 节课，共 4 节。 你可以在下方免费阅读本课时的完整内容 — 然后在浏览器中使用内置代码编辑器和全天候 AI 导师进行实践。 这是 Firebase Auth & Realtime Database Apps 学习路径的一部分，你的进度在网页和 CoddyKit 应用中同步。 Firebase Auth & Realtime Database Apps 课程共包含 4 节课。

本课时的部分内容尚未翻译，以英文显示。

Beyond Owner-Only Access

So far each user reads and writes their own data. Real apps need roles: an admin who moderates content, members who collaborate, and guests with read-only access.

Role-based access control (RBAC) layers permissions on top of authentication.

Where Roles Live

You can store a user's role in two places:

  • A roles node in the database, read inside rules
  • A custom claim on the auth token (set server-side)

Custom claims are faster to check; database roles are easier to change at runtime.

Roles in the Database

A simple model maps each uid to a role string. This data itself must be locked down so users cannot promote themselves.

{
  "roles": {
    "uid_alice": "admin",
    "uid_bob": "member"
  }
}

Checking a Database Role in Rules

Rules can read other parts of the database with root. Here only admins may write to a shared config node.

{
  "rules": {
    "config": {
      ".write": "root.child('roles').child(auth.uid).val() === 'admin'"
    }
  }
}

Custom Claims for Roles

With the Admin SDK you can attach a role to the token itself. This is checked without an extra database read.

await admin.auth().setCustomUserClaims(uid, { role: 'admin' });

Checking Claims in Rules

Custom claims appear under auth.token. The rule becomes simpler and avoids a root lookup.

{
  "rules": {
    "config": {
      ".write": "auth.token.role === 'admin'"
    }
  }
}

Reading the Claim Client-Side

The client can read its own claims to adjust the UI, for example showing an admin panel only to admins.

import { getAuth, getIdTokenResult } from 'firebase/auth';

const res = await getIdTokenResult(getAuth().currentUser);
if (res.claims.role === 'admin') showAdminPanel();

Tiered Read Access

Different roles can have different read scopes. Members read shared docs; guests read only public ones.

{
  "rules": {
    "shared": {
      ".read": "auth.token.role === 'member' || auth.token.role === 'admin'"
    }
  }
}

Protecting the Role Data Itself

Critically, users must not be able to edit their own role. Make the roles node writable only by admins (or only server-side), or self-escalation defeats the whole system.

{
  "rules": {
    "roles": {
      ".write": "auth.token.role === 'admin'"
    }
  }
}

Claim Propagation Delay

After you change a custom claim, the user's existing token still has the old value until it refreshes (about an hour, or on forced refresh). Call getIdToken(true) client-side to pick up new roles immediately.

await getAuth().currentUser.getIdToken(true);

Choosing an Approach

Use custom claims for stable, security-critical roles, and database roles when permissions change often or need to be queried. Many apps combine both.

Quick Check

Test your understanding of role-based access.

Recap

You can now grant tiered access by role.

  • Store roles in the database or as custom claims
  • Check database roles via root, claims via auth.token
  • Give roles different read/write scopes
  • Lock down the role data so users cannot self-promote
  • Refresh tokens to pick up new claims promptly

常见问题解答

「对用户数据进行基于角色的访问控制」课时是免费的吗？

是的 — 「对用户数据进行基于角色的访问控制」的完整文本可在网页上免费阅读。要进行交互式练习（内置代码编辑器和全天候 AI 导师）并解锁 Firebase Auth & Realtime Database Apps 课程的其余内容，请升级到 CoddyKit PRO。 Firebase Auth & Realtime Database Apps 课程共包含 4 节课。

「对用户数据进行基于角色的访问控制」这节课中我会学到什么？

结合 Firebase Auth 角色与 Realtime Database 规则，为管理员、成员和访客授予不同级别的共享数据和个人数据访问权限。 你通过在浏览器中直接运行的动手代码来练习 Firebase Auth & Realtime Database Apps，全天候 AI 导师会在你学习这节课的过程中回答你的问题。

学习 Firebase Auth & Realtime Database Apps 需要有经验吗？

无需任何先前经验。CoddyKit 上的 Firebase Auth & Realtime Database Apps 课程适合初学者到高级学习者，你可以从这里开始或从头开始，按照自己的节奏学习。 这是第 4 节课，共 4 节。

「对用户数据进行基于角色的访问控制」课时需要多长时间？

大多数 CoddyKit 课程大约需要 5–10 分钟。每节课都很精短且互动，所以你能稳步进步，并在网页和应用中从离开的地方继续。

我能在这节 Firebase Auth & Realtime Database Apps 课中编写并运行代码吗？

能。每节 Firebase Auth & Realtime Database Apps 课都包含内置代码编辑器，你可以在浏览器中直接编写并运行真实代码，并获得即时 AI 反馈 — 无需本地设置。

此课程中的所有课时

  1. 将用户数据连接到身份验证
  2. 实时用户资料
  3. 协作编辑数据
  4. 对用户数据进行基于角色的访问控制
← 返回 Firebase Auth & Realtime Database Apps