database.rules.json

{
  "rules": {
    "locations": {
      ".read": "auth != null"
    },
    "requests": {
      ".read": "root.child('users').child(auth.uid).child('isTutor').val() == true",
      "$tuteeID": {
        ".write": "auth.uid == $tuteeID || auth.uid == data.child('tutorID').val()",
        ".read": "auth.uid == $tuteeID || auth.uid == data.child('tutorID').val()"
      }
    },
    "tutors": {
      ".read": "auth != null",
      "$tutorID": {
        ".write": "auth.uid == $tutorID && root.child('users').child(auth.uid).child('isTutor').val() == true",
        "available": {
          ".write": "root.child('users').child(auth.uid).child('isAdmin').val() == true"
        }
      }
    },
    "subjects": {
      ".read": "auth != null"
    },
  	"users": {
      "$userID": {
        ".read": "auth.uid == $userID",
        "email": {
          ".write": "auth.uid == $userID"
        },
        "messagingToken": {
          ".write": "auth.uid == $userID"
        },
        "name": {
          ".write": "auth.uid == $userID"
        },
        "photo": {
          ".write": "auth.uid == $userID"
        }
      }
    }
  }
}