javascript - Firebase:无需创建用户登录即可授权编辑/删除操作

Question

我创建了一个应用程序，匿名用户可以在其中发表评论。现在我希望他们也编辑和删除(仅)他们的评论。不使用 firebase auth 可以做到这一点吗？由于它只是用户的一次性应用程序，因此为每个用户创建登录名有点过分了。

我尝试将 editKey 与评论对象一起存储，该对象应该允许用户编辑/删除他的评论。 (我将用户的 key 存储在浏览器的 cookie 中)

然后以某种方式拒绝通过 firebase 规则读取 editKey (".read:"false)。仅当 editKey 已知时才允许写入操作: ".write": "data.val() == newData.val()"

"comments" : {
    ".read": true,
    "$comment_id": {
        ".write": "!data.exists() && newData.exists()",
            "text": {
                ".validate": "newData.isString()"
            },
            "created": {
                ".validate": "newData.isNumber()"
            },
            "editKey": {
                ".read": false,
                ".write": "data.val() == newData.val()",
                ".validate": "newData.isString()"
            },
            "visible": {
                ".validate": "newData.isBoolean()"
            },
    }
} 

但这不起作用，因为当我为 editKey 设置规则 ".read:"false 时，应该公开的整个评论不可读

有什么想法可以没有 firebase.auth() 来实现这一点吗？

Answer 1

您正在寻找通过 Firebase 匿名进行身份验证

https://firebase.google.com/docs/auth/web/anonymous-auth#authenticate-with-firebase-anonymously

You can use Firebase Authentication to create and use temporary anonymous accounts to authenticate with Firebase. These temporary anonymous accounts can be used to allow users who haven't yet signed up to your app to work with data protected by security rules. If an anonymous user decides to sign up to your app, you can link their sign-in credentials to the anonymous account so that they can continue to work with their protected data in future sessions.