database.rules.json

{
  "rules": {
    "users": {
      "$user": {
        ".write": "auth !== null && ((auth.token.isAdmin === true && data.child('isAdmin').val() === false) || auth.uid === $user)",
        ".read": "auth !== null && ((auth.token.isAdmin === true && data.child('isAdmin').val() === false) || auth.uid === $user)"
      },
      ".write": "auth !== null && auth.token.isAdmin === true",
      ".read": "auth !== null && auth.token.isAdmin === true"
    }
  }
}