database.rules.json

{
  "rules":{
    "admin": {
      ".read": false,
      ".write": false
    },
    "draw": {
      ".read": "auth != null && root.child('admins').child(auth.token.email.replace('.', '*')).exists() && auth.token.email_verified == true",
      ".write": "auth != null"
    },
    "drawValidated":{
      ".read": "auth != null && root.child('admins').child(auth.token.email.replace('.', '*')).exists() && auth.token.email_verified == true",
      ".write": "auth != null && root.child('admins').child(auth.token.email.replace('.', '*')).exists() && auth.token.email_verified == true"
    },
    "drawShow":{
      ".read": true,
      ".write": "auth != null && root.child('admins').child(auth.token.email.replace('.', '*')).exists() && auth.token.email_verified == true"
    },
    "drawSaved":{
      "$userId":{
      	".read": "auth != null && $userId === auth.uid",
      	".write": "auth != null && root.child('admins').child(auth.token.email.replace('.', '*')).exists() && auth.token.email_verified == true"  
      }
    }
  }
}