firebase how to temporary secure data with a pincode - firebase

Question

data
{
"padlock": {
"open": 1432206070000
},
"boxes": [
{"owner": "bob", "amount": 23},
{"owner": "luca", "amount": 13},
{"owner": "louise", "amount": 4},
{"owner": "anna", "amount": 34}
]
}
security rules
{
"rules": {
"boxes": {
".read": "auth !== null",
".write": "auth !== null && root.child('padlock').child('when').val() > now - 15000"
}
}
}
Read and write to boxes is only for authenticated user.
Modification of boxes values only if the padlock is open less than 15 second ago.
To open the padlock for 15 seconds, just update the value with the current time.
How can i protect the padlock with a second simple auth layer? (like a client side pin code)
Is the only way to use privileged worker?
Web client securely send the pincode to the privileged worker. The worker will check the code and update the open timestamp. Add a security rule so only the worker as exclusive access to 'open'
Any idea?

Answer 1

I Think i found a solution just using security rules
how to protect some data from write access with a password based lock (like a pin code)
DATA
{
"boxes" : [
{"amount" : 23},
{"amount" : 11},
{"amount" : 34},
{"amount" : 3}
],
"key" : {
"oldPassword" : "xxxxxxx",
"password" : "xxxxxxx"
},
"lock" : {
"password" : "xxxxxxx",
"open" : 1432292525055
}
}
RULES
{
"rules": {
"key": {
// nobody can read the key
".read": false,
// only people who know the key can change it
// if no key exists you can stil create it
".write": "data.child('password').val() === newData.child('oldPassword').val() || !data.exists()",
// password (string) must exists and be different than the old one
".validate": "newData.child('password').isString() && newData.child('oldPassword').isString() && newData.child('password').val() !== newData.child('oldPassword').val()"
},
"lock": {
// nobody can read the lock
".read": false,
// only people knowing the key can create the lock
// to prevent partial write (without the password), only create and delete are authorized (no data update)
".write": "(!data.exists() && root.child('key').child('password').val() === newData.child('password').val()) || !newData.exists()",
// open is the creation time
".validate": "newData.child('open').val() === now"
},
"boxes": {
".read": "true",
// write only allowed for 15 sec after the padlock is open
".write": "root.child('padlock').child('open').val() > now - 15000"
}
}
}