基于Firestorm的iOS/Android应用权限咨询：用户只读管理员专属发布

Hey there! Let's tackle your Firestorm questions clearly and practically.

1. How to set up read-only access for regular users and publish-only access for admins #

The core of this setup lies in security rules and user authentication. Here's how to pull it off:

• First, integrate Firestorm's authentication system into your app. This lets you identify user identities and distinguish regular users from admins.
• Mark admin accounts: You can either add an isAdmin: true field to the admin's user document in your users collection, or use custom auth claims (a more secure option for role-based access).
• Configure security rules for your news stream collection:
  • Grant all users (even unauthenticated ones, if you want open access) read permission.
  • Restrict write/publish permissions only to users marked as admins.
    Example rule snippet (adjust to Firestorm's actual rule syntax):

  match /news/{newsItem} {
    // Allow any user to read news content
    allow read: if true;
    // Only admins can create/update/delete news
    allow write: if request.auth != null && request.auth.token.isAdmin == true;
  }
  

  If you're using a user document to mark admins, the rule would look like this:

  allow write: if request.auth != null && get(/databases/default/documents/users/$(request.auth.uid)).data.isAdmin == true;
  

2. Should you build two UI views or publish directly from the Firestorm backend? #

It depends on your workflow needs—here's the breakdown:

• Option 1: Publish via Firestorm backend + read-only app UI (recommended for most cases)
  If you only need to publish content occasionally, this is the simplest approach. You don't need to build any publish functionality in your iOS/Android apps—just develop the news stream view for regular users. You'll add/edit news directly through Firestorm's web console.
  Pros: Less development work, lower risk of permission leaks since there's no publish entry in the app, and it's straightforward to manage content.
• Option 2: Build dual UI views (regular user + admin)
  Go with this if you need to publish content quickly from your mobile device. In your app, add logic to check if the current user is an admin—if yes, show the publish/edit UI components; if not, only show the news stream.
  Critical note: Never rely solely on UI hiding for security. Your security rules must still enforce admin-only write access, so even if a regular user somehow finds the publish UI, they won't be able to submit changes.

Quick Recommendation #

Start with the backend publish approach first—it's faster to implement and less error-prone. If you later find you need mobile publishing, you can add the admin UI to your app while keeping the strict security rules in place.

内容的提问来源于stack exchange，提问作者Manley