database-rules.json

{
  "rules": {
    "feed": {
      "$uid": {
        ".read": "auth.uid === $uid",
        ".write": "auth.uid === $uid",
        "$postId": {
          ".validate": "newData.val() === true && newData.parent().parent().parent().child('posts').child($postId).exists()"
        }
      }
    },
    "posts": {
      ".read": true,
      "$postId": {
        ".write": "!data.exists() || data.exists() && auth.uid === data.child('author').child('uid').val()", // Allow new writes and allow updates and deletes to own posts.
        "author": {
          "uid": {
            ".validate": "auth.uid === newData.val()"
          }
        }
      }
    },
    "comments": {
      ".read": true,
      "$postId": {
        ".write": "!newData.exists() && auth.uid === root.child('posts').child($postId).child('author').child('uid').val() && !newData.parent().parent().child('posts').child($postId).exists()", // Allow deletes from the post owner
        ".validate": "root.child('posts').child($postId).exists()", // Check that the post exists
        "$commentId": {
          ".write": "!data.exists() || data.exists() && auth.uid === data.child('author').child('uid').val()",  // Can write new comments and edit/delete particular comment if you are the author.
          "author": {
            "uid": {
              ".validate": "auth.uid === newData.val()"
            }
          }
        }
      }
    },
    "likes": {
      ".read": true,
      "$postId": {
        ".write": "!newData.exists() && auth.uid === root.child('posts').child($postId).child('author').child('uid').val() && !newData.parent().parent().child('posts').child($postId).exists()", // Allow deletes from the post owner
        ".validate": "root.child('posts').child($postId).exists()", // Check that the post exists
        "$uid": {
          ".write": "auth.uid === $uid",
          ".validate": "newData.val() === now"
        }
      }
    },
    "followers": {
      ".read": true,
      "$followedUid": {
        "$followerUid": {
          ".write": "auth.uid === $followerUid", // Can only add yourself as a follower
          ".validate": "newData.val() === true && newData.parent().parent().parent().child('people').child($followerUid).child('following').child($followedUid).exists()" // Makes sure /people/.../following is in sync
        }
      }
    },
    "people": {
      ".indexOn": ["_search_index/full_name", "_search_index/reversed_full_name"],
      ".read": true,
      "$uid": {
        ".write": "auth.uid === $uid",
        "full_name": {
          ".validate": "newData.isString()"
        },
        "profile_picture": {
          ".validate": "newData.isString()"
        },
        "posts": {
          "$postId": {
            ".validate": "newData.val() === true && newData.parent().parent().parent().parent().child('posts').child($postId).exists()"
          }
        },
        "_search_index": {
          "full_name": {
            ".validate": "newData.isString()"
          },
          "reversed_full_name": {
            ".validate": "newData.isString()"
          }
        },
        "following": {
          "$followedUid": {
            ".validate": "newData.parent().parent().parent().parent().child('followers').child($followedUid).child($uid).val() === true" // Makes sure /followers is in sync
          }
        }
      }
    },
    "$other": {
      ".validate": false
    }
  }
}