3 ms·
Same. I feel like I'm missing something by the vast majority of other comments saying roll their own/unknown third party
by whiskey14 4y ago
Same. I feel like I'm missing something by the vast majority of other comments saying roll their own/unknown third party
- moomoo11 4y agoI think if I had my own enterprise product with a lot more complexity, I would roll my own. It’s possible I am using the product wrong, but I found it kind of hard to use the rules engine for granular access. What I did instead is make my own simple permissions engine and since my backend APIs verify against the firebase token, I then pass that into my rules engine before it writes any mutations. I lock down firestore access by using my own api that then uses the admin sdk. Obviously this is a bit slower but it gives me the most confidence that only my backend services can make changes to the data.
- whiskey14 4y agoSame as well. Basically authentication->firebase, authorization->backend api (I normally write custom python decorators for this)