How to Implement a Secure Data Sharing Feature in FlutterFlow

In FlutterFlow, go to Firestore and create a new collection named `shares`. Add the following fields: `resourceId` (String — the document ID of the shared item), `resourceType` (String — e.g., `document`, `project`), `ownerId` (String — the sharing user's UID), `sharedWith` (JSON Array of objects with `uid` String and `level` String — values: `view`, `edit`, `admin`), `shareToken` (String, nullable — for public link sharing), `tokenExpiry` (Timestamp, nullable), `createdAt` (Timestamp). One `shares` document exists per shared resource. The `sharedWith` array contains one entry per invited user. Using a single document per resource (rather than one document per share invitation) makes Security Rules simpler and atomic updates possible.

This is the critical step. In the Firebase console, go to Firestore > Rules and replace the default rules for your resource collection. The rules should allow read if the requesting user is the owner OR if their UID appears in the `sharedWith` array with any permission level. Allow writes only if the user has `edit` or `admin` level. Allow admin operations (updating the shares document) only for the resource owner. Test all rules with the Firebase Rules Playground before saving. Deploy the rules from the Firebase console — FlutterFlow does not have a built-in rules editor.

1rules_version = '2';
2service cloud.firestore {
3  match /databases/{database}/documents {
4
5    function getShare(resourceId) {
6      return get(/databases/$(database)/documents/shares/$(resourceId)).data;
7    }
8
9    function shareLevel(resourceId) {
10      let share = getShare(resourceId);
11      let entry = share.sharedWith
12        .filter(s, s.uid == request.auth.uid);
13      return entry.size() > 0 ? entry[0].level : null;
14    }
15
16    match /documents/{docId} {
17      allow read: if request.auth != null &&
18        (resource.data.ownerId == request.auth.uid ||
19         shareLevel(docId) != null);
20
21      allow write: if request.auth != null &&
22        (resource.data.ownerId == request.auth.uid ||
23         shareLevel(docId) in ['edit', 'admin']);
24    }
25
26    match /shares/{shareId} {
27      allow read: if request.auth != null &&
28        (resource.data.ownerId == request.auth.uid ||
29         shareLevel(shareId) != null);
30
31      allow write: if request.auth != null &&
32        resource.data.ownerId == request.auth.uid;
33
34      allow create: if request.auth != null &&
35        request.resource.data.ownerId == request.auth.uid;
36    }
37  }
38}

Create a reusable Component called `ShareDialog`. Add a parameter `resourceId` (String) and `resourceType` (String). Inside the component, add a TextField for entering an email address and a DropdownButton for selecting permission level (View / Edit / Admin). Add an Invite button and a list of current shares — query the `shares` collection where `resourceId == resourceId parameter` to display existing collaborators with their levels and a Remove button for each. Add a separate section with a Toggle for enabling a public share link. The entire dialog is a reusable component so you can drop it into any page that has shareable resources.

When the user enters an email and clicks Invite, you need to convert the email to a Firebase UID before updating the `shares` document — because Firestore Security Rules and array queries use UIDs, not emails. Create a Cloud Function named `lookupUserByEmail` that takes an email string, calls `admin.auth().getUserByEmail(email)`, and returns the UID. In FlutterFlow, wire the Invite button to: call the Cloud Function, receive the UID, then run a Firestore Update Document action on the `shares/{resourceId}` document using `FieldValue.arrayUnion` equivalent — add `{uid: returnedUID, level: selectedLevel}` to the `sharedWith` array. Show an error message if the Cloud Function returns no user (email not registered).

For shareable links, create a Cloud Function named `createShareToken` that generates a cryptographically random token (using `crypto.randomBytes(32).toString('hex')`), writes it to `shares/{resourceId}.shareToken` with a `tokenExpiry` 7 days in the future, and returns the full share URL. In FlutterFlow, a second Cloud Function `redeemShareToken` accepts a token string, queries Firestore for a `shares` document where `shareToken == token` and `tokenExpiry > now()`, verifies the token is valid, then adds the current user's UID to the `sharedWith` array with `view` level and clears the token. The share link URL format should be `yourapp.com/join?token=abc123` — create a `/join` page in FlutterFlow that reads the `token` query parameter and calls `redeemShareToken` on page load.

Query the current user's permission level from the `shares` document on pages that display shared resources. Store the level in an App State variable `currentPermissionLevel`. Use FlutterFlow's Conditional Visibility to show Edit buttons only when `currentPermissionLevel` is `edit` or `admin`, and the Share/Invite button only when the level is `admin` or the user is the owner. Add a visual indicator (a badge or subtitle) showing the user's current access level — `Owner`, `Admin`, `Editor`, or `Viewer`. Remember: this UI gating is for usability only. The Security Rules you wrote in Step 2 are what actually enforces these limits.