How to do a cascading remove in Angularfire?

Question

How do I in the best possible way remove a user and his/her profile (the profile has it's own node with the $uid as the key) in the best way in Firebase?

Should I just do a $remove() on the profile and then a $userRemove(), or is there a better way? If I have my rules setup properly I can't access the profile for a deletion after I deleted the user I guess, since only the user has write access to the profile.

"profiles": {
  "$uid": {
    // grants write access to the owner of this profile whose uid must exactly match the key ($uid)
    ".write": "auth !== null && auth.uid === $uid",
    // grants read access to any user who is logged in with an email and password
    ".read": "auth !== null && auth.provider === 'password'"
  }
}

This is how I figure it could be done, but what happens if one of the calls goes through and not the other, then it's an inconsistent user/profile left.

var firebaseObj = new Firebase(FBURL),
    Auth = $firebaseAuth(firebaseObj);

var profileObj = $firebase(firebaseObj.child('profiles').child(user.uid)).$asObject();

profileObj.$remove().then(function(data) {
    return Auth.$removeUser(user);
}).then(function(data) {
    console.log('successfully removed user and profile');
});

Note: I have not tested the code above, just wanted to get other peoples thoughts about how to do this and provide a rough example of how I could do it.

Answer 1

Deleting the user will not invalidate the auth token and will not log the user out of the account. This is a common misconception with OAuth tokens--that tokens are some sort of real-time, living component that constantly monitors the server for changes. OAuth tokens are valid until they are revoked.

In Firebase, an OAuth token is revoked when:

• the secret used to create it is revoked
• the token expires

One can also effectively revoke access by adding a dependency in the data which is checked in security rules. In this way, access can be prevented to the data even though the existing token is still valid.

The ordering here would therefore not matter. You can delete the account and remove the record simultaneously without concern that the user would somehow lose access.

Also, this isn't a cascading remove, since one operation is removing user credentials (which are an encrypted hash of email/pass -> uid), and the other is physically deleting data from Firebase--these ops are completely independent and not at all related other than the constraints you've placed on the data for your app.