How can I secure Firebase Realtime Database rules for two-way messaging between users and business profiles?

Got the solution now. Sharing for anyone who might get benefit of the approach. Thanks

JSONCopied
{
  "rules": {
    ".read": false, // disables general read access
    ".write": false, // disables general write access

    "Users": {
      ".read": "auth != null", // Users can read all profiles
      
      "$userUid": {
        ".write": "auth != null && auth.uid === $userUid", // Users can write only their own data
        
        ".validate": "newData.child('userUid').val() === auth.uid && 
              
              (!newData.child('userID').exists() || newData.child('userID').isNumber()) &&
              (!newData.child('userName').exists() || 
               (newData.child('userName').isString() && newData.child('userName').val().length > 0)) &&
              (!newData.child('userFCMToken').exists() || 
               (newData.child('userFCMToken').isString() && newData.child('userFCMToken').val().length > 0)) &&
              (!newData.child('userPhoneLanguage').exists() || newData.child('userPhoneLanguage').isString()) &&

              (!newData.child('userProfileImage').exists() || 
               (newData.child('userProfileImage').isString() && 
                newData.child('userProfileImage').val().matches(/^https:\/\/xxxx\//))) &&

              (!newData.child('userBusiness1Id').exists() || newData.child('userBusiness1Id').isNumber()) &&
              (!newData.child('userBusiness1Name').exists() || 
               (newData.child('userBusiness1Name').isString() && newData.child('userBusiness1Name').val().length > 0)) &&
              (!newData.child('userBusiness1ProfileImage').exists() || 
               (newData.child('userBusiness1ProfileImage').isString() && 
                newData.child('userBusiness1ProfileImage').val().matches(/^https:\/\/xxx\//))) &&

              (!newData.child('userBusiness2Id').exists() || newData.child('userBusiness2Id').isNumber()) &&
              (!newData.child('userBusiness2Name').exists() || 
               (newData.child('userBusiness2Name').isString() && newData.child('userBusiness2Name').val().length > 0)) &&
              (!newData.child('userBusiness2ProfileImage').exists() || 
               (newData.child('userBusiness2ProfileImage').isString() && 
                newData.child('userBusiness2ProfileImage').val().matches(/^https:\/\/xxxx\//)))
      }
    },
        "User-Messages": {
      "$userId": {
        ".read": "auth != null && (<
          auth.uid === $userId || <
          auth.uid + '_' + root.child('Users').child(auth.uid).child('userBusiness1Id').val() === $userId ||
          auth.uid + '_' + root.child('Users').child(auth.uid).child('userBusiness2Id').val() === $userId<
        )",
        "$recipientId": {
          ".write": "auth != null && (<
            auth.uid === $userId || // Sender can write to their own path<
            auth.uid === $recipientId || // Sender can write to the recipient's path<
            $recipientId === auth.uid + '_' + root.child('Users').child(auth.uid).child('userBusiness1Id').val() ||  // When sender is business1, sender can write to user's path<
            $recipientId === auth.uid + '_' + root.child('Users').child(auth.uid).child('userBusiness2Id').val() ||  // When sender is business2, sender can write to user's path<
            auth.uid + '_' + root.child('Users').child(auth.uid).child('userBusiness1Id').val() === $userId || // Business1 sender<
            auth.uid + '_' + root.child('Users').child(auth.uid).child('userBusiness2Id').val() === $userId // Business2 sender<
          )",
        "$messageId": {
            ".validate": "newData.child('chatId').exists() && newData.child('chatId').isString() && newData.child('chatId').val().length > 0 &&<
                          newData.child('fromId').exists() && newData.child('fromId').isString() && newData.child('fromId').val().length > 0 &&<
                          newData.child('toId').exists() && newData.child('toId').isString() && newData.child('toId').val().length > 0 &&<
                          newData.child('timestamp').exists() && newData.child('timestamp').isNumber() && newData.child('timestamp').val() > 0 &&<
                          newData.child('text').exists() && newData.child('text').isString() && <
                          newData.child('text').val().length > 0 &&<
                          newData.child('messageIsRead').exists() && newData.child('messageIsRead').isBoolean() &&<
                          (!newData.child('membershipRequest').exists() || (newData.child('membershipRequest').isString()))<
          }
        }
      }
    },
}

Unlike relational databases, the right structure for a NoSQL database doesn't depends much on the actual structure of the data. Rather it depends on the use-cases of your app, which typically you won't fully know at the start of your app.

---

I typically recommend follow the principle of least privilege, which means that your security rules should only allow the minimum access that allows the current use-cases of the app.

JSONCopied
{
  "rules": {
    ".read": false,
    ".write": false
  }
}

So before you've written any code, that means that the rules should allow no access whatsoever.

---

Now you add the code for your first use-case. In your case that seems to be adding a child node under User-Messages.

Note: the Swift code in your question doesn't actually write any database yet. I assume that you want to add a simply text value under the new reference and toReference paths.

Once you run the code with the rules we set in the previous steps it will fails, which is exactly what you want to see.

The rules you have in your question are this:

JSONCopied
"User-Messages": {
  ".write": "auth != null",
  ".read": "auth != null"
}

This says that anyone who is signed in can write whatever they want under User-Messages. While allows adding a new messages, it is much broader than what your code actually does. So it does not follow the principle of least privilege.

With your rules, any user can write any message to any other user (likely unwanted). Or worse, they can delete all messages between all users by writing an empty value to the top-level User-Messages node. And even if those are valid use-cases that you want to allow for your app at some point, the current code doesn't need that level of access - so the security rules shouldn't allow it either.

If we model what your code does in the security rules, we end up with something like this:

JSONCopied
"User-Messages": {
  "$fromUid": {
    "$toUid": {
      "$pushId": {
        ".write": "auth != null && (auth.uid === fromUid || auth.uid === toUid)"
      }
    }
  }
}

I hope you can see how closely this mimics your code: this uses wildcard variables so that a user can now only write a message under the full path /User-Messages/$fromUid/toUid/$pushId, which is exactly what your code does.

More so, the write is only allowed if their UID matches either one of the parent keys, which I assume is the use-case you want.

---

You'll typically also want to add some data validation to the security rules, like the maximum length of the message and maybe who can send a message to whom.

Again, as said above, the goal here is to ensure that the security rules only allow exactly what your code currently does and needs and nothing more.

---

Once you're done with all of these, move on the code for your next use-case.