Definition of firebase security rules

Question

How can I define a safety rule that:

1. Allow read and write access to recipes if the logged in user is the user who registered it
2. Allow read access to recipes if the tipo for true
3. Do not allow read and write access to recipes if the logged in user is not the user who registered it
4. Allow read and write access to users if the username and password sent are the same registered (login), I imagine something with newData
5. How to allow reading of the user name, not to allow two users with the same name, in the most secure way possible

Data structure:

{
  "receitas" : {
    "-L7bAaMB-vaJhri6r-lg" : {
      "imagem" : "default",
      "ingrediente" : [ "teste" ],
      "nome" : "teste",
      "preparo" : "teste",
      "tipo" : false,
      "usuario": "-L7WxcAHr8LkfJAiI8ku"
    },
    "-L7bAqvMu8uOoY6nX5Tx" : {
      "imagem" : "example.png",
      "ingrediente" : [ "teste2" ],
      "nome" : "teste2",
      "preparo" : "teste2",
      "tipo" : true,
      "usuario": "-L7WxcAHr8LkfJAiI8ku"
    }
  },
  "usuarios" : {
    "-L7WxcAHr8LkfJAiI8ku" : {
      "senha" : "123456789",
      "usuario" : "guilherme"
    },
    "-L7bAk3EcsoOQapV9zsb" : {
      "senha" : "123456789",
      "usuario" : "patricia"
    }
  }
}

Answer 1

1.To verify if the logged-in user is the user who registered the revenue, the variable is used auth.uid and the newData (in the case of writing) or data (in reading). That would be:

"receitas":{
            "$idReceita":{
                ".write":"auth.uid == newData.child('usuario').val()",
                ".read":"auth.uid == data.child('usuario').val()"
            }
        }

2.Just add one more condition in the read that checks the type: ".read":"auth.uid == data.child('usuario').val() || data.child('tipo').val() == true"

5.With the current structure, it is not possible to have unique names in the database. For this, I recommend that you create a new node (I will call "names") where you will have all the names as keys, because keys are unique and cannot be repeated. That knot would look like this:

{
    "nomes":{
        "guilherme":true,
        "patricia":true
    }
}

Thus, the rule not to repeat names would be:

".validate":"root.child('nomes').child(newData.child('usuario').val()).val() != true"

And then the rules would stay like this:

{
    "rules":{
        "receitas":{
            "$idReceita":{
                ".write":"auth.uid == newData.child('usuario').val()",
                ".read":"auth.uid == data.child('usuario').val() || data.child('tipo').val() == true"
            }
        },
        "usuarios":{
            "$uid":{
                ".write":"auth.uid == $uid",
                ".read":"auth!=null",
                ".validate":"root.child('nomes').child(newData.child('usuario')).val() != true"
            }
        },
        "nomes":{
            ".write":"auth!=null",
            ".read":"auth!=null"
        }
    }
}

Learn more about Realtime Database security rules in this article.