基于Firebase的APP：如何实现管理员审核并展示合规用户上传照片

Hey there! Let's break down how to implement both of your requirements—restricting photo uploads to admin-approved users, and ensuring only compliant photos show up on your homepage. I'll split this into two clear sections to make it easy to follow.

1. Restrict Uploads to Admin-Approved Users #

First, we need to make sure only users you've explicitly allowed can upload photos to Firebase Storage. Here's the step-by-step approach:

Step 1: Add User Role Flags in Firestore #

Create a users collection in Firestore where each document corresponds to a user (use the Firebase Auth UID as the document ID). Add these fields to each user document:

• isAdmin: Boolean (set to true only for your account)
• isApprovedUploader: Boolean (default to false for regular users; you'll toggle this as admin)

Step 2: Frontend Upload Validation #

Before a user attempts to upload a photo, fetch their Firestore user document and check if isApprovedUploader is true. If not, show a friendly error like: "You need admin approval to upload photos."

Example snippet (Kotlin for Android, adjust to your platform):

val currentUser = FirebaseAuth.getInstance().currentUser
currentUser?.let { user ->
    FirebaseFirestore.getInstance().collection("users").document(user.uid)
        .get()
        .addOnSuccessListener { doc ->
            val isApproved = doc.getBoolean("isApprovedUploader") ?: false
            if (isApproved) {
                // Proceed with upload flow
            } else {
                // Show approval required message
            }
        }
}

Step 3: Secure Firebase Storage Rules #

Add rules to ensure only approved users or admins can upload files. Update your storage.rules file:

rules_version = '2';
service firebase.storage {
  match /b/{bucket}/o {
    // Allow uploads only for approved users or admins
    match /unapproved/{userId}/{imagePath=**} {
      allow write: if request.auth != null && 
        (request.auth.token.isApprovedUploader == true || request.auth.token.isAdmin == true);
    }
    // Allow read access to approved files (we'll cover this later)
    match /approved/{userId}/{imagePath=**} {
      allow read: if true; // Or restrict further if needed
    }
  }
}

Note: We're using an unapproved folder for pending photos—more on that in the next section.

Step 4: Build an Admin Approval Interface #

Create a simple admin dashboard (you can make this a hidden screen in your app or a web portal) that lists all users. As admin, you can toggle the isApprovedUploader flag for any user, updating their Firestore document when you do.

2. Ensure Only Compliant Photos Show on the Homepage #

Next, we need to validate photo content and only display approved, compliant images in your RecyclerView. Here's how to set this up:

Step 1: Adjust Upload Flow for Pending Approval #

When an approved user uploads a photo:

1. Upload it to the unapproved/{userId}/{imageName} path in Storage.
2. Create a new document in a photos collection in Firestore with these fields:
   • storagePath: String (path to the unapproved file)
   • userId: String (uploader's UID)
   • uploadTimestamp: Timestamp
   • isApproved: Boolean (default false)
   • complianceStatus: String (default PENDING; options: SAFE, UNSAFE, PENDING)

Step 2: Automate or Manual Compliance Checks #

You have two options to validate photo compliance—use a mix of both for best results:

Option A: Automated Content Detection with Firebase ML Kit

Set up a Cloud Function that triggers when a new photos document is created. The function will:

1. Fetch the image from Storage using the storagePath.
2. Use Firebase ML Kit's Content Moderation API to scan for inappropriate content (pornography, violence, etc.).
3. Update the complianceStatus field to SAFE or UNSAFE based on the results.

Example Cloud Function snippet (Node.js):

const functions = require("firebase-functions");
const admin = require("firebase-admin");
const ml = admin.ml();

admin.initializeApp();

exports.checkPhotoCompliance = functions.firestore
  .document("photos/{photoId}")
  .onCreate(async (snap, context) => {
    const photoData = snap.data();
    const storagePath = photoData.storagePath;
    
    // Get the image file from Storage
    const file = admin.storage().bucket().file(storagePath);
    const [buffer] = await file.download();
    
    // Run ML Kit content moderation
    const inputConfig = {
      content: { image: { encodedImage: buffer.toString("base64") } },
    };
    const response = await ml.generateContentModeration(inputConfig);
    
    // Update compliance status
    const isSafe = response.moderationResults.every(result => result.suggestion == "SAFE");
    return snap.ref.update({
      complianceStatus: isSafe ? "SAFE" : "UNSAFE"
    });
  });

Option B: Manual Admin Review

Add a section to your admin dashboard that lists all photos with complianceStatus: SAFE and isApproved: false. As admin, you can review these photos and toggle isApproved to true if they meet your guidelines. For photos marked UNSAFE, you can delete them from Storage and Firestore.

Step 3: Promote Approved Photos to Public Access #

When a photo is marked approved: true:

1. Use a Cloud Function (or admin dashboard code) to move the image from unapproved/ to approved/ in Storage.
2. Update the storagePath in the Firestore document to the new approved path, and generate a public download URL for it.

Step 4: Filter RecyclerView Data #

In your app's homepage, query the photos collection with these filters to only fetch approved, compliant photos:

FirebaseFirestore.getInstance().collection("photos")
    .whereEqualTo("isApproved", true)
    .whereEqualTo("complianceStatus", "SAFE")
    .orderBy("uploadTimestamp", Query.Direction.DESCENDING)
    .addSnapshotListener { snapshot, error ->
        // Update RecyclerView with the filtered results
    }

Bonus: Lock Down Firestore Rules #

Make sure only admins can modify the isApproved and complianceStatus fields. Update your firestore.rules:

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /photos/{photoId} {
      allow read: if true; // Or restrict to authenticated users
      allow create: if request.auth != null && request.auth.token.isApprovedUploader == true;
      allow update: if request.auth != null && request.auth.token.isAdmin == true;
    }
    match /users/{userId} {
      allow read: if request.auth.uid == userId;
      allow update: if request.auth != null && request.auth.token.isAdmin == true;
    }
  }
}

内容的提问来源于stack exchange，提问作者Ahmet Aydemir