firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    // Helper functions
    function isAuthenticated() {
      return request.auth != null;
    }

    function isAdmin() {
      return request.auth != null && request.auth.token.admin == true;
    }

    function isSuperAdmin() {
      return request.auth != null && request.auth.token.email == "felix@i7v6.com";
    }

    function isOwner() {
      return resource.data.userId == request.auth.uid;
    }

    // User-scoped collections - users can only access their own data
    // For list queries, the where("userId", "==", uid) constraint must match the rule
    match /sources/{docId} {
      allow get: if isAuthenticated() && resource.data.userId == request.auth.uid;
      allow list: if isAuthenticated();
      allow create: if isAuthenticated() && request.resource.data.userId == request.auth.uid;
      allow update, delete: if isAuthenticated() && resource.data.userId == request.auth.uid;
    }

    match /transactions/{docId} {
      allow get: if isAuthenticated() && resource.data.userId == request.auth.uid;
      allow list: if isAuthenticated();
      allow create: if isAuthenticated() && request.resource.data.userId == request.auth.uid;
      allow update, delete: if isAuthenticated() && resource.data.userId == request.auth.uid;

      // Edit history subcollection
      match /history/{entryId} {
        allow read: if isAuthenticated();
        allow create: if isAuthenticated();
        allow update, delete: if false; // History entries are immutable
      }
    }

    match /files/{docId} {
      allow get: if isAuthenticated() && resource.data.userId == request.auth.uid;
      allow list: if isAuthenticated();
      allow create: if isAuthenticated() && request.resource.data.userId == request.auth.uid;
      allow update, delete: if isAuthenticated() && resource.data.userId == request.auth.uid;
    }

    match /partners/{docId} {
      allow get: if isAuthenticated() && resource.data.userId == request.auth.uid;
      allow list: if isAuthenticated();
      allow create: if isAuthenticated() && request.resource.data.userId == request.auth.uid;
      allow update, delete: if isAuthenticated() && resource.data.userId == request.auth.uid;
    }

    match /emailIntegrations/{docId} {
      allow get: if isAuthenticated() && resource.data.userId == request.auth.uid;
      allow list: if isAuthenticated();
      allow create: if isAuthenticated() && request.resource.data.userId == request.auth.uid;
      allow update, delete: if isAuthenticated() && resource.data.userId == request.auth.uid;
    }

    match /emailTokens/{docId} {
      // Tokens should only be accessible via Cloud Functions (admin SDK)
      allow read, write: if false;
    }

    match /imports/{docId} {
      allow get: if isAuthenticated() && resource.data.userId == request.auth.uid;
      allow list: if isAuthenticated();
      allow create: if isAuthenticated() && request.resource.data.userId == request.auth.uid;
      allow update, delete: if isAuthenticated() && resource.data.userId == request.auth.uid;
    }

    match /noReceiptCategories/{docId} {
      allow get: if isAuthenticated() && resource.data.userId == request.auth.uid;
      allow list: if isAuthenticated();
      allow create: if isAuthenticated() && request.resource.data.userId == request.auth.uid;
      allow update, delete: if isAuthenticated() && resource.data.userId == request.auth.uid;
    }

    match /aiUsage/{docId} {
      allow get: if isAuthenticated() && resource.data.userId == request.auth.uid;
      allow list: if isAuthenticated();
      allow create: if isAuthenticated() && request.resource.data.userId == request.auth.uid;
      // No update/delete - usage records are immutable
    }

    match /functionCalls/{docId} {
      // Users can read their own function call records (for usage dashboard)
      allow get: if isAuthenticated() && resource.data.userId == request.auth.uid;
      allow list: if isAuthenticated();
      // Write handled by Cloud Functions only (via Admin SDK)
      allow write: if false;
    }

    match /fileConnections/{docId} {
      allow get: if isAuthenticated() && resource.data.userId == request.auth.uid;
      allow list: if isAuthenticated();
      allow create: if isAuthenticated() && request.resource.data.userId == request.auth.uid;
      allow update, delete: if isAuthenticated() && resource.data.userId == request.auth.uid;
    }

    match /gmailSyncQueue/{docId} {
      allow get: if isAuthenticated() && resource.data.userId == request.auth.uid;
      allow list: if isAuthenticated();
      // Write handled by Cloud Functions
    }

    match /gmailSyncHistory/{docId} {
      allow get: if isAuthenticated() && resource.data.userId == request.auth.uid;
      allow list: if isAuthenticated();
      // Write handled by Cloud Functions
    }

    match /inboundEmailAddresses/{docId} {
      allow get: if isAuthenticated() && resource.data.userId == request.auth.uid;
      allow list: if isAuthenticated();
      allow create: if isAuthenticated() && request.resource.data.userId == request.auth.uid;
      allow update, delete: if isAuthenticated() && resource.data.userId == request.auth.uid;
    }

    match /inboundEmailLogs/{docId} {
      allow get: if isAuthenticated() && resource.data.userId == request.auth.uid;
      allow list: if isAuthenticated();
      // Write handled by Cloud Functions (email webhook)
    }

    // User document and subcollections
    match /users/{userId} {
      allow read, write: if request.auth != null && request.auth.uid == userId;

      match /settings/{settingId} {
        allow read, write: if request.auth != null && request.auth.uid == userId;
      }

      match /notifications/{notificationId} {
        allow read, write: if request.auth != null && request.auth.uid == userId;
      }

      match /chatSessions/{sessionId} {
        allow read, write: if request.auth != null && request.auth.uid == userId;

        match /messages/{messageId} {
          allow read, write: if request.auth != null && request.auth.uid == userId;
        }
      }

      // UVA/Tax reports
      match /reports/{reportId} {
        allow read, write: if request.auth != null && request.auth.uid == userId;
      }

      // MFA settings - users can read/write their own
      match /mfaSettings/{settingId} {
        allow read, write: if request.auth != null && request.auth.uid == userId;
      }

      // Passkeys - users can read their own, write handled by Cloud Functions
      match /passkeys/{credentialId} {
        allow read: if request.auth != null && request.auth.uid == userId;
        allow write: if false; // Cloud Functions only
      }

      // Backup codes - Cloud Functions only (users get count through operations layer)
      match /backupCodes/{codeId} {
        allow read, write: if false; // Cloud Functions only
      }

      // Passkey challenge - temporary storage for WebAuthn challenges
      match /passkeyChallenge/{challengeId} {
        allow read, write: if request.auth != null && request.auth.uid == userId;
      }

      // Worker requests - queued automation tasks
      match /workerRequests/{requestId} {
        allow read, write: if request.auth != null && request.auth.uid == userId;
      }

      // Worker runs - completed automation transcripts
      match /workerRuns/{runId} {
        allow read: if request.auth != null && request.auth.uid == userId;
        allow write: if false; // Cloud Functions / API only
      }
    }

    // Admin-only collections
    match /allowedEmails/{docId} {
      allow read, write: if isAdmin() || isSuperAdmin();
    }

    match /accessRequests/{docId} {
      allow read: if isAdmin() || isSuperAdmin();
      allow write: if false; // Cloud Functions only
    }

    match /globalPartners/{docId} {
      // Everyone can read global partners, only admins can write
      allow read: if isAuthenticated();
      allow write: if isAdmin() || isSuperAdmin();
    }

    match /promotionCandidates/{docId} {
      allow read, write: if isAdmin() || isSuperAdmin();
    }

    // Precision search queue - user read, Cloud Functions write
    match /precisionSearchQueue/{docId} {
      allow read: if isAuthenticated() && (resource == null || isOwner());
      allow create: if isAuthenticated() && request.resource.data.userId == request.auth.uid;
      // Updates handled by Cloud Functions
    }

    // Agentic search sessions - track chat-based receipt search state
    match /agentSearchSessions/{docId} {
      allow get: if isAuthenticated() && resource.data.userId == request.auth.uid;
      allow list: if isAuthenticated();
      allow create: if isAuthenticated() && request.resource.data.userId == request.auth.uid;
      allow update, delete: if isAuthenticated() && resource.data.userId == request.auth.uid;
    }

    // MFA audit logs - users can read their own, write handled by Cloud Functions
    match /mfaAuditLogs/{docId} {
      allow read: if isAuthenticated() && (resource == null || isOwner());
      allow write: if false; // Cloud Functions only
    }

    // User data exports - users can read their own, write handled by Cloud Functions
    match /userExports/{docId} {
      allow get: if isAuthenticated() && resource.data.userId == request.auth.uid;
      allow list: if isAuthenticated();
      allow write: if false; // Cloud Functions only
    }

    // User data imports - users can read their own, write handled by Cloud Functions
    match /userImports/{docId} {
      allow get: if isAuthenticated() && resource.data.userId == request.auth.uid;
      allow list: if isAuthenticated();
      allow write: if false; // Cloud Functions only
    }

    // BMD exports - users can read their own, write handled by Cloud Functions
    match /bmdExports/{docId} {
      allow get: if isAuthenticated() && resource.data.userId == request.auth.uid;
      allow list: if isAuthenticated();
      allow write: if false; // Cloud Functions only
    }

    // API keys - users can read their own, write handled by Cloud Functions
    match /apiKeys/{docId} {
      allow get: if isAuthenticated() && resource.data.userId == request.auth.uid;
      allow list: if isAuthenticated();
      allow write: if false; // Cloud Functions only
    }

    // Subscriptions - users can read their own, write handled by Cloud Functions (Stripe webhook + callables)
    match /subscriptions/{userId} {
      allow read: if request.auth != null && request.auth.uid == userId;
      allow write: if false; // Cloud Functions only
    }

    // Config - public read (open seats shown on registration), Cloud Functions write only
    match /config/{docId} {
      allow read: if true;
      allow write: if false; // Cloud Functions only
    }

    // Country expansion - public read (marketing page), Cloud Functions write only
    match /countryExpansion/{countryCode} {
      allow read: if true;
      allow write: if false; // Cloud Functions only
    }

    // Country backers - admin read only, Cloud Functions write only
    match /countryBackers/{docId} {
      allow read: if isAdmin() || isSuperAdmin();
      allow write: if false; // Cloud Functions only
    }

    // Referrals - public read (needed to validate codes), Cloud Functions write only
    match /referrals/{code} {
      allow read: if true;
      allow write: if false; // Cloud Functions only
    }

    // Referral conversions - referrer can read their own, Cloud Functions write only
    match /referralConversions/{docId} {
      allow read: if isAuthenticated() && resource.data.referrerUserId == request.auth.uid;
      allow write: if false; // Cloud Functions only
    }
  }
}