katowulf/1_using_queries.js

Last active May 9, 2017

A quick update for the emailToKey function. Using a global regex match on the period, for those that have emails like [email protected], will replace all periods, not just the first instance.

// Only the 1st period gets replaced
"[email protected]".replace('.', ',')
// RESULT: "y,[email protected]"

// All periods get replaced
"[email protected]".replace(/\./g, ',')
// RESULT: "y,u,no,work@gmail,com"

nice

Consider hashing the email address to completely avoid the problem of invalid characters. Base64 encoding is baked into JavaScript. Since it's reversible, it's technically not cryptographic but more convenient than importing a SHA1 / MD5 library. For example:

function emailToKey(emailAddress){
  return btoa(emailAddress);
}

Small thing: in createNewUser when supplying the key 'emails_to_ids/'+userRecord.email, does it do the conversion from periods to commas automatically? For noobs like me it would be good to put this in the comments or explicitly use emailToKey() for both the write and the lookup.

@al-the-x
+1 have found this method to be the most efficient - if you do use md5 it does allow for quick/easy use for Gravatar, but Base64 provides lower overhead.

@bridgkick emailToKey isn't getting called implicitly in createNewUser. I'm guessing this was just missed and createNewUser should actually read:

function createNewUser( userRecord ) {
   var id = fb.child('user').push(userRecord).name();
   fb.child('emails_to_ids/'+emailToKey(userRecord.email)).set(id);
   return id;
}

@al-the-x @freidamachoi watch out, base64 can fail

http://stackoverflow.com/questions/23223718/failed-to-execute-btoa-on-window-the-string-to-be-encoded-contains-characte

Love the btoa solution. Can email addresses even have characters outside the latin1 range? @kristijanmatic @al-the-x

I'm guessing that the security rules for emails_to_ids would be:

"emails_to_ids":{
    "$email":{
        ".read":"<User has need to lookup id by email>",
        ".write":"<User has ability to create an email, or change the address of an email>"
    }
}

This would still allow the user to guess email addresses to look up IDs, but would not allow them to lookup the whole list, decode it, and be able to get the IDs from there.

If there is a need for the ID to remain secret, the only way would be a second table that has a second generated id to actual id lookup, and a server-side process that would handle the actions, but the rules on the actual user list should make the ID's secret irrelevant.

Actually, the path needs to be writeable for creating a new user, as well as anyone that wants to change their email address. This means that it has to be world writeable, thus world readable.

@mikemurray Addressed comments and updated for Firebase queries. Thanks!
@jondthompson world writable/readable isn't necessary. You can make paths editable only by the owner's uid.

@al-the-x hashes are a great answer but btoa isn't necassarily available cross-platform. It just requires including a hash function of some sort or a polyfill for btoa, so still a great choice.

This is awesome, thanks!

var uid = fb.child('user').push().key();
For me it's working as a prop and not a method, so .key instead of .key()