database.rules.json

{
  "rules": {
    "decks": {
      // only logged-in users can see decks
      ".read": "auth != null"
    },
    "games": {
      ".indexOn": "host",
      // banned users can't see any game
      ".read": "!root.child('banned/'+auth.uid).exists()",
      // only admins can create and modify any game
      ".write": "root.child('admins/'+auth.uid).exists()",
      "$game_key": {
        // guests can create new games, but only the host can modify
        ".write": "root.child('guests/'+auth.uid).exists() && (newData.child('host').val() === auth.uid || data.child('host').val() === auth.uid)"
      }
    },
    "users": {
      // only logged-in unbanned users can see users
      ".read": "auth != null && !root.child('banned/'+auth.uid).exists()",
      // only admins can modify any user
      ".write": "root.child('admins/'+auth.uid).exists()",
      "$uid": {
        "games": {
          // only logged-in users can modify their own games
          ".write": "auth != null && auth.uid == $uid"
        }
      }
    }
  }
}