How to allow read/write objects only to authenticated user with Firebase? - angularjs

Question

I am trying to make a simple test of storing notes objects in Firebase, with user security rules that ensure the notes can be read and write only to the author.
Here is what the data stored in firebase looks like:
my_firebase_db
- notes
- K835Tw_H28XXb-Sj4b
- text: "note 1 from author 1",
- user_id: "11b09925-534b-4955-ac55-3e234809432f"
- K835Tw_H28XXb-Sj4b
- text: "note 1 from author 2",
- user_id: "11b09925-534b-4955-ac55-4d223893382c"
- K835Tw_H28XXb-Sj4b
- text: "note 2 from author 2",
- user_id: "11b09925-534b-4955-ac55-4d223893382c"
Angular code (AngularFire) that authenticates the user with a custom token, load notes and method to add a note:
var ref = new Firebase("https://xxx.firebaseio.com");
// Authenticate users with a custom authentication token
$firebaseAuth(ref).$authWithCustomToken(data.token).then(function(authData) {
console.log("Logged in as:", authData.uid);
$scope.user_id = authData.uid;
}).catch(function(error) {
console.error("Authentication failed:", error);
});
// Load notes
$scope.notes = $firebaseArray(ref.child('notes'));
$scope.addNote = function() {
note = {
user_id: $scope.user_id,
text: $scope.newNote.text
};
$scope.notes.$add(note);
};
Security & rules setup in Firebase:
{
"rules": {
"notes": {
".read": "auth != null && data.child('user_id').val() === auth.uid",
".write": "auth != null && newData.child('user_id').val() === auth.uid"
}
}
}
With these rules, read & write is not allowed.
If I change the rules to this, then read & write are allowed (but authors can read everybody's notes):
{
"rules": {
"notes": {
".read": "auth != null",
".write": "auth != null"
}
}
}
How can I write a security rule in firebase that will allow the authenticated user to read & write their own notes?

Answer 1

Turns out the answer was here: "Rules Are Not Filters".