Earlier quoted context omitted.
Question: How do you deal with authorisation? I've still yet to come up with a solution I'm happy with unfortunately; I'm currently relying on a custom token generated server-side that grants given users particular claims that I then check in the database rules, but it feels... brittle, I guess.
Exact same thing that we are using for a realtime collaborative app. Generate token on server-side with access to certain keys. However, we had to redo our json structure once we started thinking authorisation. It sucked and in retrospect should have thought about it earlier, but it seems to work. Typically authorisation layers on top of existing data, but in this case, we had to redo data structure keeping auth in m…
That's pretty much exactly it, I guess. It honestly just feels less "secure" than I'd like, even if it's not!