firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    // Helper function to check if user is authenticated
    function isAuthenticated() {
      return request.auth != null;
    }

    // Helper function to check if user owns the document
    function isOwner(userId) {
      return isAuthenticated() && request.auth.uid == userId;
    }

    // Usernames lookup collection (enforces uniqueness)
    match /usernames/{username} {
      allow read: if isAuthenticated();
      allow create: if isAuthenticated() && request.resource.data.uid == request.auth.uid;
      allow delete: if isAuthenticated() && resource.data.uid == request.auth.uid;
      allow update: if false; // usernames cannot be reassigned
    }

    // Users collection
    match /users/{userId} {
      allow read: if isOwner(userId);
      allow write: if isOwner(userId);
    }

    // Projects collection
    match /projects/{projectId} {
      allow read: if isAuthenticated() && (request.auth.uid == resource.data.userId || resource.data.isPublic == true);
      allow create: if isAuthenticated() && request.resource.data.userId == request.auth.uid;
      // Only allow updating safe fields — storageURL, contentHash, userId are immutable after creation
      allow update: if isAuthenticated()
                    && request.auth.uid == resource.data.userId
                    && request.resource.data.userId == resource.data.userId
                    && request.resource.data.contentHash == resource.data.contentHash
                    && request.resource.data.diff(resource.data).affectedKeys()
                       .hasOnly(['title', 'isPublic', 'tags', 'updatedAt', 'thumbnailData']);
      allow delete: if isAuthenticated() && request.auth.uid == resource.data.userId;
    }

    // Gallery collection — sharing to gallery is an explicit user action that
    // opts the item into public visibility. All gallery items are readable by
    // any authenticated user by design (no per-item visibility flag needed).
    match /gallery/{itemId} {
      allow read: if isAuthenticated();
      allow write: if isAuthenticated() && request.auth.uid == resource.data.userId;
      allow create: if isAuthenticated() && request.resource.data.userId == request.auth.uid;
    }

    // NFTs collection (listed NFTs are readable by any authenticated user)
    match /nfts/{nftId} {
      allow read: if isAuthenticated() && (request.auth.uid == resource.data.userId || resource.data.isListed == true);
      allow write: if isAuthenticated() && request.auth.uid == resource.data.userId;
      allow create: if isAuthenticated() && request.resource.data.userId == request.auth.uid;
    }
  }
}