Firebase - splitting tables between secure and insecure fields -

is there best practice structuring firebase tables/objects between secure data fields (which users not trusted update themselves) , insecure data, may set themselves?

for example, user should free change name or preferences inside own users object, should not free change settings such if they're paid user, email confirmed, etc. or user specific example, user.name should editable user directly, while user.email should changed via our own api, update firebase's record.

this seems must common requirement, because see in every table need. e.g. have users, have projects, have tasks within project, etc. , each of data types, there fields user-editable , ones not.

so type of approach best practice? here 2 possibilities:

secure_data:   users:     user1:       email:     user2:   projects:   tasks: insecure_data:   users:     user1:       name:     user2:   projects:   tasks: 

or:

users:   user1:     secure:       email:     insecure:       name: projects:    project1:      secure:      insecure: tasks: 

by way, this answer implies first option above should used, wanted structure question more see if there's indeed best practice this.

there entire guide covering best practices, including topics on data structures , security related auth, includes live demo.

as previously linked question covers use cases reading secured data, i'll assume you're not asking same question, , you're interested in write restrictions. if want read restrictions, question duplicate; won't able iterate or query on path unless data in path readable.

write restrictions straightforward; grant write access relevant fields.

for example, if user should able write email not paid status:

{   "rules": {      "users": {         "$uid": {            // allow write access email not paid status            "email": ".write": "auth.uid === $uid"         }      }   } }