database.rules.json

{
  /* Visit https://firebase.google.com/docs/database/security to learn more about security rules. */
  "rules": {
    "rounds": {
      ".read": "auth !== null",
      "$round": {
        ".write": "auth !== null && (!newData.child('score').exists() || newData.child('phase').val() === 4) &&(!newData.child('cloudScore').exists())"
      }
    },
    "guesses": {
      "$round": {
        ".read": "auth !== null",
        ".write": "auth !== null && (newData.child('guess').val() === 0 || !root.child('rounds/' + $round).exists() || root.child('rounds/' + $round + '/phase').val() < 2 ) ",
        "guess": {
          ".validate": "newData.isNumber() && newData.val() >=0 && newData.val() <=100"
        }
      }
    },
    "finalGuesses": {
      "$round": {
        ".write": "auth !== null && newData.parent().parent().child('rounds').child($round).child('phase').val() == 4 && auth.uid == newData.child('user').val()  ",
        "value": {
          ".validate": "newData.isNumber() && newData.val() >= 0 &&  newData.val() <= 100"
        },
        "timestamp": {
          ".validate": "newData.val() < now + 10 && newData.val() > now -1000"
        }
      }
    },
    "roundsPrivate": {
      "$round": {
        ".read": "root.child('rounds/' + $round + '/phase').val() === 4",
        ".write": "auth.uid === root.child('rounds/' + $round + '/teller').val() && 0 === root.child('rounds/' + $round + '/phase').val() ",
        ".validate": "auth.uid === newData.child('teller').val()",
        "truePosition": {
          ".validate": "newData.isNumber() && newData.val() >=0 && newData.val() <=100"
        }
      }
    },
    "users": {
      ".read": "auth !== null",
      ".indexOn": "lastSeen",
      "$userId": {
        ".write": "auth.uid === $userId",
        "displayName": {
          ".validate": "newData.isString() && newData.val().length > 2 && newData.val().length < 20"
        }
      }
    }
  }
}