firestore.rules

rules_version = '2';

service cloud.firestore {
  match /databases/{database}/documents {

    // Authenticated Users: Can manage their own profile and payment requests.
    match /users/{userId} {
      // Only the authenticated user can access their own user document.
      allow read, write: if request.auth != null && request.auth.uid == userId;

      // Payment requests subcollection for authenticated users.
      match /paymentRequests/{paymentRequestId} {
        // Only the user who owns this subcollection can manage their payment requests.
        allow read, create, update, delete: if request.auth != null && request.auth.uid == userId;
      }
    }

    // Public Payment Requests: For anonymous users.
    match /publicPaymentRequests/{paymentRequestId} {
      // Anyone can read a single public payment request.
      allow get: if true;
      
      // Anyone can create a public payment request.
      allow create: if request.auth == null;

      // Nobody can list, update, or delete public requests.
      allow list, update, delete: if false;
    }
  }
}