title: How to secure database access on firestore?
body: <p>I am working on a hospital project where each doctor must have access to his/her patient's documents and his/her own documents only. Here is my current db structure:</p>
  
  <p><a href="https://i.stack.imgur.com/4ZhwB.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/4ZhwB.png" alt="enter image description here"></a></p>
  
  <p>I will give doctors, their passwords by hand.
  So that's why, I am thinking about creating some passwords, hashing and salting them. Storing the passwords on a paper, not on any part of the PC. </p>
  
  <p>When it comes to the database access, my doctors should be able to access their own documents and update their patients documents.</p>
  
  <p>Here is what I think for signing in a user :</p>
  
  <ol>
  <li>Get the entered password from the user.</li>
  <li>Hash the password.</li>
  <li>Salt the password.(Salt is fetched from the db)</li>
  <li>Get the hash value of users password from db and check their equality.</li>
  <li>Let the user in if they are equal.</li>
  <li>Get the user's Uid.</li>
  <li>Let the user access to the documents with the Uid of their own or their patients. (This seems now right for me. But i don't know a better way.)</li>
  </ol>
  
  <p>I doubt step 7 mostly. Showing me a better way or a document about it or telling me why doing so is secure will be very helpful. Thanks in advance.</p>