rules.json

{
  "rules": {
    ".write": "auth !== null && auth.uid === 'server'",

    "currentGame": {
      ".read": true
    },

    "events": {
      ".read": true,

      "$event": {
        ".validate": "newData.hasChildren(['imageUrl', 'text', 'type'])",
        "imageUrl": {
          ".validate": "newData.isString()"
        },
        "text": {
          ".validate": "newData.isString()"
        },
        "type": {
          ".validate": "newData.isString() && (newData.val() === 'newGame' || newData.val() === 'suggestion' || newData.val() === 'move' || newData.val() === 'gameOver')"
        },
        "$other": {
          ".validate": "true"
        }
      }
    },

    "loggedInUsers": {
      // TODO: I'd like to set ".read" to false but I need to have a way to determine how many total
      // users there are without looping through each of them, which requires ".read" to be true here.
      ".read": true,
      ".write": "auth != null",

      "$provider": {
        "$uid": {
          ".validate": "auth.provider == $provider && auth.uid == $uid && newData.hasChildren(['imageUrl', 'userUrl', 'username'])",

          "imageUrl": {
            ".validate": "newData.isString()"
          },
          "userUrl": {
            ".validate": "newData.isString()"
          },
          "username": {
            ".validate": "newData.isString()"
          },
          "$other": {
            ".validate": "false"
          }
        }
      }
    },

    "suggestions": {
      ".read": true,
      ".write": "auth != null && root.child('currentGame').child('whoseTurn').val() == auth.provider",

      "$uid": {
        ".validate": "auth.uid == $uid && newData.hasChildren(['gridIndex', 'rowIndex', 'columnIndex', 'previousSuggestion'])",

        "gridIndex": {
          ".validate": "newData.isNumber()"
        },
        "rowIndex": {
          ".validate": "newData.isNumber()"
        },
        "columnIndex": {
          ".validate": "newData.isNumber()"
        },
        "previousSuggestion": {
          ".validate": "newData.hasChildren(['gridIndex', 'rowIndex', 'columnIndex']) || newData.val() === false"
        },
        "$other": {
          ".validate": "false"
        }
      }
    },

    "wins": {
      ".read": true
    }
  }
}