database.rules.json

{
  "rules": {
    "games": {
      "$gameId": {
        ".read": "auth != null",
        "startedAt": {
          ".write": "auth != null && auth.uid == data.parent().child('host').val() && !data.exists() && newData.exists()",
          ".validate": "newData.isNumber() && newData.val() == now"
        },
        "status": {
          ".write": "auth != null && data.parent().child('users/' + auth.uid).exists() && data.exists() && newData.exists()",
          ".validate": "newData.isString() && (data.val() == 'waiting' && newData.val() == 'ingame' && auth.uid == data.parent().child('host').val())"
        },
        "users": {
          "$userId": {
            ".write": "auth != null && auth.uid == $userId && data.parent().parent().child('status').val() == 'waiting'",
            ".validate": "!newData.exists() || (newData.isNumber() && newData.val() == now)"
          }
        },
        "mode": {
          ".write": "auth != null && auth.uid == data.parent().child('host').val() && newData.exists()",
          ".validate": "newData.isString()&& (newData.val() == 'normal' || newData.val() == 'ultraset' || newData.val() == 'setchain')"
        },
        "enableHint": {
          ".write": "auth != null && auth.uid == data.parent().child('host').val() && newData.exists()",
          ".validate": "newData.isBoolean()"
        }
      }
    },
    "gameData": {
      "$gameId": {
        ".read": "auth != null",
        "events": {
          "$eventId": {
            ".write": "!data.exists() && newData.exists() && auth != null && root.child('games/' + $gameId + '/users/' + auth.uid).exists()",
            ".validate": "newData.hasChildren(['user', 'time', 'c1', 'c2', 'c3'])",
            "user": {
              ".validate": "newData.isString() && newData.val() == auth.uid"
            },
            "time": {
              ".validate": "newData.isNumber() && newData.val() == now"
            },
            "c1": {
              ".validate": "newData.isString() && newData.val().matches(/^[0-2]{4}$/)"
            },
            "c2": {
              ".validate": "newData.isString() && newData.val().matches(/^[0-2]{4}$/)"
            },
            "c3": {
              ".validate": "newData.isString() && newData.val().matches(/^[0-2]{4}$/)"
            }
          }
        }
      }
    },
    "users": {
      ".indexOn": "connections",
      "$userId": {
        ".read": "auth != null",
        ".write": "auth != null && (auth.uid == $userId || root.child('users').child(auth.uid).child('admin').val() == true)",
        ".validate": "newData.hasChildren(['color', 'name'])",
        "color": {
          ".validate": "newData.isString()"
        },
        "name": {
          ".validate": "newData.isString() && newData.val().length > 0 && newData.val().length <= 25"
        },
        "lastOnline": {
          ".validate": "newData.isNumber() && newData.val() == now"
        },
        "connections": {
          "$connectionId": {
            ".validate": "newData.isString() || !newData.exists()"
          }
        },
        "banned": {
          ".validate": "newData.isNumber()"
        },
        "$other": {
          ".validate": false
        }
      }
    },
    "userGames": {
      "$userId": {
        ".read": "auth != null",
        ".indexOn": ".value",
        "$gameId": {
          ".write": "auth != null && auth.uid == $userId",
          ".validate": "!newData.exists() || (newData.isNumber() && newData.val() == root.child('games/' + $gameId + '/createdAt').val())"
        }
      }
    },
    "userStats": {
      "$userId": {
        ".read": "auth != null"
      }
    },
    "publicGames": {
      ".read": "auth != null",
      ".indexOn": ".value"
    },
    "chats": {
      "$chatId": {
        ".read": "auth != null",
        ".indexOn": ["time", "user"],
        "$messageId": {
          ".write": "auth != null && ((!data.exists() && newData.exists()) || (data.exists() && root.child('users').child(auth.uid).child('admin').val() == true))",
          ".validate": "newData.hasChildren(['user', 'message', 'time'])",
          "user": {
            ".validate": "newData.isString() && newData.val() == auth.uid"
          },
          "message": {
            ".validate": "newData.isString() && newData.val().length > 0 && newData.val().length <= 250"
          },
          "time": {
            ".validate": "newData.isNumber() && newData.val() == now"
          },
          "$other": {
            ".validate": false
          }
        }
      }
    },
    "lobbyChat": {
      ".read": "auth != null",
      ".indexOn": ["time", "user"],
      "$messageId": {
        ".write": "auth != null && ((!data.exists() && newData.exists()) || (data.exists() && root.child('users').child(auth.uid).child('admin').val() == true))",
        ".validate": "newData.hasChildren(['user', 'message', 'time'])",
        "user": {
          ".validate": "newData.isString() && newData.val() == auth.uid"
        },
        "message": {
          ".validate": "newData.isString() && newData.val().length > 0 && newData.val().length <= 250"
        },
        "time": {
          ".validate": "newData.isNumber() && newData.val() == now"
        },
        "$other": {
          ".validate": false
        }
      }
    },
    "stats": {
      ".read": "auth != null"
    }
  }
}