Function output replaces auth.uid if a $uid wildchild is in location

[eygraber]

If I have a rule that looks like this:

- location: something/$uid
  read: canDoSomething($uid)

functions:
  - canDoSomething(uid): auth.uid === uid

the output will be:

auth.$uid === $uid

[eygraber]

Actually it looks like it goes a little deeper than what I said above. The parameters to functions don't get replaced recursively.

- location: something/$uid
  read: canDoSomething($uid, '1')

functions:
  - canDoSomething(uid, one):      auth.uid === uid && canDoSomethingElse(one)
  - canDoSomethingElse(uid): root.some.path[uid].exists()

outputs:

auth.$uid === $uid && root.child('some').child('path').child($uid).exists()

So I pass one to canDoSomethingElse but since its parameter is named uid it uses uid from canDoSomething which resolves to $uid instead of '1'

[mckoss]

FYI - I've just started work on a Blaze alternative and ran your example through the new Bolt language:

path /something/$uid {
     read() { return canDoSomething($uid, '1'); }
}

function canDoSomething(uid, one) { return auth.uid === uid && canDoSomethingElse(one); }

function canDoSomethingElse(uid) { return root.some.path[uid].exists(); }

results in:

{
  "rules": {
    "something": {
      "$uid": {
        ".read": "auth.uid == $uid && root.child('some').child('path').child('1').exists()"
      }
    }
  }
}

Bolt is in early Alpha now - but I'd love you feedback on it, since you've been using Blaze.

[eygraber]

Awesome! I'll definitely try that out when I get a chance.

[tomlarkworthy]

Yeah there are some bugs still in the parameter sanitation, the short term fix is to avoid reuse of variable names.