firebase.rules.json

{
  "rules": {
    "$environment": {
      ".read": "root.child($environment).child('users:permissions').child(auth.uid).child('admin').val() === true", // is ADMIN
      ".write": "root.child($environment).child('users:permissions').child(auth.uid).child('admin').val() === true", // is ADMIN

      "versions": {
        ".read": true
      },
      "faqs": {
        ".read": true
      },
      "featureFlags": {
        ".read": true
      },
      "competitions": {
        ".read": true,
        "$competitionId": {
          ".write": "root.child($environment).child('users:permissions').child(auth.uid).child('competitions').child($competitionId).val() === true" // has PERMISSION
        },
        ".indexOn": ["date"]
      },
      "competitions:data": {
        "$competitionId": {
          "staff": {
            ".read": true
          },
          "invites": {
            "$inviteId": {
              ".read": "auth !== null", // is AUTHED
              ".write": "auth !== null" // is AUTHED
            }
          },
          ".read": "root.child($environment).child('competitions').child($competitionId).child('published').val() === true || root.child($environment).child('users:permissions').child(auth.uid).child('competitions').child($competitionId).val() === true", // is PUBLISHED || has PERMISSION
          ".write": "root.child($environment).child('users:permissions').child(auth.uid).child('competitions').child($competitionId).val() === true" // has PERMISSION
        }
      },
      "competitions:submissions": {
        "$competitionId": {
          ".write": "auth !== null && !data.exists() && !newData.child('approved').exists()" // is AUTHED and CREATING and NOT approving
        }
      },
      "competitions:permissions": {
        "$competitionId": {
          ".read": "root.child($environment).child('users:permissions').child(auth.uid).child('competitions').child($competitionId).val() === true" // has PERMISSION to same COMPETITION
        }
      },
      "users": {
        "$userId": {
          ".read": "auth !== null && auth.uid === $userId", // is SELF
          ".write": "auth !== null && auth.uid === $userId" // is SELF
        }
      },
      "users:favorites": {
        "$userId": {
          ".read": "auth !== null && auth.uid === $userId", // is SELF
          ".write": "auth !== null && auth.uid === $userId" // is SELF
        }
      },
      "users:permissions": {
        "$userId": {
          ".read": "auth !== null && auth.uid === $userId", // is SELF
          ".write": "auth !== null && auth.uid === $userId && !newData.exists()" // is REMOVING OWN permissions
        }
      }
    }
  }
}