Example of CanActivate being used to check if a user is logged in or not via Firebase - see https://leightley.com/angular-2-and-firebase-authentication-route-guard/

canActivate.js

import { Injectable } from '@angular/core';
import { CanActivate, ActivatedRouteSnapshot, RouterStateSnapshot, Router } from '@angular/router';
import { Observable } from 'rxjs/Observable';
import { AngularFireAuth } from 'angularfire2/auth';
import 'rxjs/add/operator/do';
import 'rxjs/add/operator/map';
import 'rxjs/add/operator/take';


@Injectable()
export class AuthGuard implements CanActivate {
  constructor(private afAuth: AngularFireAuth, private router: Router, private) {}

  canActivate(
    next: ActivatedRouteSnapshot,
    state: RouterStateSnapshot): Observable<boolean> {

      return this.afAuth.authState
       .take(1)
       .map(user => {
         return !!user
       })
       .do(loggedIn => {
         if (!loggedIn) {
           console.log("access denied")
           this.router.navigate(['/login']);
         }
     })
   }
}

This is great! I've just figured that using the afAuth.authState Observable in my AuthGuard make my weird Firebase DB 'PERMISSION DENIED' issue go away 👍