firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {

    // ── User-scoped data ─────────────────────────────────────────────────────
    // Only the authenticated owner can read/write their own data.
    // Uses UID matching (not email) — more secure and cannot be spoofed.
    match /users/{userId}/{document=**} {
      allow read, write: if request.auth != null
                         && request.auth.uid == userId;
    }

    // ── Daily logs: field-level validation ───────────────────────────────────
    match /users/{userId}/daily_logs/{dateKey} {
      allow read: if request.auth != null && request.auth.uid == userId;
      allow write: if request.auth != null
                   && request.auth.uid == userId
                   // Validate that user_id in document matches the authenticated user
                   && (!request.resource.data.keys().hasAny(['user_id'])
                       || request.resource.data.user_id == request.auth.uid);
    }

    // ── Global data: field-level validation ──────────────────────────────────
    match /users/{userId}/global_data/{docName} {
      allow read: if request.auth != null && request.auth.uid == userId;
      allow write: if request.auth != null && request.auth.uid == userId;
    }

    // ── Deny all other paths ────────────────────────────────────────────────
    match /{document=**} {
      allow read, write: if false;
    }
  }
}