firebase-rules.json

{
  "rules": {

    "users": {
      ".indexOn": ["userSince"],

      "$uid": {
        // you can only read/write your own stuff:
        ".read": "$uid === auth.uid",
        ".write": "$uid === auth.uid",
        
        // exception for some public user info:
        "user": {
          "displayName": {
            ".read": true
          }
        },
        // and for shared tags/notes (set by sharer on sharer's docs):
        "tags": {
          "$tagId": {
            // kind of the canonical data
            ".read": "data.child('/share/' + auth.uid).exists()"
          }
        },
        "nuts": {
          "$nutId": {
            // duplicated by sharer client for ease of security rule checking
            ".read": "data.child('/share/' + auth.uid).exists()"
          }
        },
        // and somewhere for sharers to write their own share invites to (set by sharer on recipient's object)
        "sharedWithMe": {
          "tags": {
            "$sharerUid": {
              // will contain tag id -> permissions (permissions match: /(r|w|x|d)\??/)
              ".write": "$sharerUid === auth.uid"
            }
          }
        }
      }
    },

    "emailToId": {
      ".read": true,
      "$email": {
        ".write": "newData.val() === auth.uid"
      }
    },

    // This is for user's smart tags to be able to queue up emails to send. We enforce uid being their own uid so that they can only email to their own email address.
    "queuedEmails": {
      ".indexOn": ["sendAt"],

      ".read": false,
      "$emailInfo": {
        ".write": "(data.child('uid').val() === auth.uid || ! data.exists()) && (newData.child('uid').val() === auth.uid || ! newData.exists())",
        ".validate": "newData.hasChildren(['type', 'sendAt', 'subject', 'tagId']) && newData.child('sendAt').isNumber()"
      }
    },

    "feedback": {
      ".read": false,
      ".write": true
    },
    "newFeatures": {
      ".read": true,
      ".write": false
    },
    "newFeatureCount": {
      ".read": true,
      ".write": false
    }
  }
}