EMAS Serverless provides a simple and clear set of security rules to control client application access to resources. These rules, which are similar to the file permission system in Linux, ensure data security. For cloud databases, you can configure permission rules in the console to manage read and write permissions for data collections.
Database operations initiated from the console, Cloud Functions, or the management software development kit (SDK) are not restricted by these security rules.
Rule syntax
Database access permissions are configured at the collection level. A JSON rule defines the access restrictions for different operations on a collection. The following is an example.
{
".read": true,
".write": "request.auth.userId==resource.auth.userId"
}The syntax conventions for expressing permission rules in JSON are as follows:
The text must be valid JSON.
The key represents the operation type:
.read: Read operation..write: Write operation.*: All operations.
The value for an operation type can be:
true: The operation is allowed.false: The operation is denied.request.auth.userId==resource.auth.userId: Verifies the user's identity. Only the data owner can perform the operation.
Currently, only the
.readand.writeoperation types are explicitly supported.Specific rules for operation types take precedence over wildcard character matches.
If a wildcard character is not configured, you must explicitly configure permission rules for both
.readand.write.
Preset permission descriptions
The following table lists common preset database permissions in EMAS Serverless and provides examples of custom permissions using JSON.
Rule name |
Corresponding rule details |
Description |
|---|---|---|
Open all permissions (must be written as a custom rule. Recommended for debugging only) |
|
All users have full read and write permissions for this data collection.
Note
This permission rule grants all database operation permissions. Use this rule with caution. |
All users can read, only the creator and administrators can write |
|
Public read access. The creator has read and write permissions. Example scenarios include user comments or public information. |
Only the creator and administrators can read and write |
|
Only the creator can read and write. Example scenario: Product information. |
All users can read, only administrators can write |
|
All users have read-only access. Example scenarios include product information. |
Only administrators can read and write |
|
No users have read or write permissions. This is used for writing backend data streams or logs exclusively from the business backend. |
For more information about modifying database permissions, see Set data table permissions.
Default rule
For a newly created database, EMAS Serverless automatically provides a default rule. By default, all users have read permission, and only administrators have write permission. Before you start testing, adjust the permission rules. For more information, see Set data collection permissions.
This permission corresponds to the following JSON rule expression:
{
".read": true,
".write": false
}Creator-only access
To restrict access to data in a collection to only its creator, use the following permission rule to verify the user's identity: request.auth.userId==resource.auth.userId. The following two preset permissions use this rule:
All users can read, only the creator and administrators can write.
Only the creator and administrators can read and write.
When the
.writepermission (including wildcard matches) is set to creator-only write, write operations from the creator automatically insert an `auth` field containing the creator's `userId`. This field is inserted automatically and cannot be modified.When the
.readpermission (including wildcard matches) is set to creator-only read, a user can only access data containing an `auth` field whose `auth.userId` value matches their `userId`.If data previously uploaded by a user does not contain an `auth` field, and the collection's permission is later changed to creator-only read, that user may not be able to pull the data.