title: Firebase Security: read and write access from data values
body: <p>I'm building a simple data structure and I'm hoping the Firebase security rules can accommodate it. </p>
  
  <p>Right now I'm getting <code>PERMISSION_DENIED</code> for <strong>read privileges</strong>. </p>
  
  <p>I know you're usually supposed to design your data structure around the security rules but there are <strong>very specific reasons</strong> for this data structure<br>
  So I'd like to try and make the security rules work around it.</p>
  
  <p>Here's the json export of my data:
  </p>
  
  <pre><code>{
    "form" : {
      "form" : {
        "data" : "Form",
        "owner" : "116296988270749049875",
        "public" : true
      }
    },
    "users" : {
      "116296988270749049875" : {
        "data" : "Daniel Murawsky"
      }
    }
  }
  </code></pre>
  
  <p>And here's what I've got for the security rules so far:
  </p>
  
  <pre><code>{
      "rules": {
          "$form":{
            "$dataId":{
              ".read": "data.child('public').val() == true",
              ".write": "data.child('owner').val() == auth.uid"
            }
          }
      }
  }
  </code></pre>
  
  <p>I've never seen a use case for having two <code>$location</code> variables, one after another, so I can imagine that being the problem. Any input is welcome.<br>
  Thanks!</p>
  
  <p><strong>UPDATE</strong></p>
  
  <p>Thanks to Frank's recomendation to use the security simulator  (https://.firebaseio.com/?page=Simulator), I quickly figured out the problem with a little bit of play. Thanks Frank!</p>
  
  <p>I didn't understand (even though I read it a dozen times) the concept that <a href="https://www.firebase.com/docs/security/guide/securing-data.html#section-cascade" rel="nofollow">Rules Cascade</a>. Once I got it, it was easy.</p>