security-rules.json

{
  "rules": {
    "documents": {
      "$document_id": {
        ".write": "(data.child('public').val() === true) || (auth != null && ((data.child('owner_uid').val() == auth.uid) || !data.exists()))",
        ".read": "(data.child('public').val() === true) || (auth != null && data.child('owner_uid').val() == auth.uid)",
        ".validate": "data.exists() || $document_id.matches(/^[0-9a-f]{40}$/)",
        "owner_uid": {
          ".validate": "newData.val() == auth.uid && !data.exists() && !(data.parent().child('public').val() === true)"
        },
        "nodes": {
          "$node_id": {
            ".validate": "newData.hasChildren(['x', 'y', '_'])",
            "x": { ".validate": "newData.isNumber()" },
            "y": { ".validate": "newData.isNumber()" },
            "_": { ".validate": "newData.isString()" }
          }
        },
        "title": { ".validate": "newData.isString()" },
        "public": {
          ".write": false,
          ".validate": "newData.isBoolean()"
        },
        "$other": { ".validate": false }
      }
    },
    "stats": {
      ".read": true,
      ".write": true
    },
    "$other": { ".validate": false }
  }
}