database rules

rules.js

{
  "rules": {
    "messages": {
      "$roomId": {
        // users can only chat in their own private room. admins can chat anywhere.
        ".read": "$roomId === auth.uid || auth.token.admin === true",
        "$messageId": {
          // can only write new data, not modify old
          ".write": "($roomId === auth.uid || auth.token.admin === true) && !data.exists() && newData.exists()", 
          // must contain only userId and body
          ".validate": "newData.hasChildren(['userId', 'body'])",
          "userId": {
            // you can only create messages as yourself            
            ".validate": "newData.val() === auth.uid"
          },
          "body": {
            // body must be a non-empty string 
            ".validate": "newData.isString() && newData.val().length > 0"
          },
          "$other": {
            // all other fields are rejected
            ".validate": false
          }
        },
      }
    }
  }
}