firestore.rules

rules_version = '2';

// Security rules for the Hull chore board.
//
// Model: the kids' board needs no login (read everything; tick chores;
// pick avatars). Only the two parent Google accounts may reassign chores,
// edit the recurring defaults, or delete days.
//
// The parent allowlist below is generated from allowlist.json — the single
// source of truth also used by admin.html. To add/remove a parent:
//   1. edit allowlist.json
//   2. run `node scripts/sync-allowlist.js` to regenerate the block below
//   3. redeploy these rules (Firestore rules can't fetch allowlist.json at
//      eval time, so this file must carry its own copy)
// scripts/check-allowlist-sync.js (run in CI on every PR) fails the build if
// this block ever drifts from allowlist.json. Enable Google sign-in in the
// Firebase console (Authentication > Sign-in method) for this to work.
service cloud.firestore {
  match /databases/{database}/documents {

    function isParent() {
      return request.auth != null
        && request.auth.token.email_verified == true
        // ALLOWLIST:START — generated by scripts/sync-allowlist.js, do not hand-edit
        && request.auth.token.email.lower() in [
             'hullst89@gmail.com',
             'kerilynhull@gmail.com'
           ];
        // ALLOWLIST:END
    }

    // A board "tick" only changes a kid's completion state, nothing else.
    function choreTickOnly() {
      return request.resource.data.diff(resource.data).affectedKeys().hasOnly(['state', 'updatedAt']);
    }

    // Avatar picking is a kid action on the board — stays open.
    match /chores/avatars {
      allow read: if true;
      allow write: if true;
    }

    // Day docs + the `templates` doc.
    match /chores/{doc} {
      allow read: if true;
      // New day doc: a kid's first tick creates it with only state/updatedAt.
      allow create: if isParent()
                    || request.resource.data.keys().hasOnly(['state', 'updatedAt']);
      // Updates: kids may tick chores; parents may change anything
      // (assignments, away, templates...).
      allow update: if isParent() || choreTickOnly();
      // Only parents may delete (admin "reset day" / "restore defaults").
      allow delete: if isParent();
    }

    // Nothing else in the project is reachable.
    match /{document=**} {
      allow read, write: if false;
    }
  }
}