mrbarletta

Since the user decides who'd they like to share the list with, I'd store that information in the user data itself. For example:

{
  "rules": {
    "$userPath": {
      ".write": "$userPath == 'acc_' + auth.id",
      ".read": "$userPath == 'acc_' + auth.id || root.child($userPath).child('shared').hasChild(auth.id)"
    }
  }
}