firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    function isAdmin() {
      return request.auth != null && request.auth.token.admin == true;
    }

    // Make sure the uid of the requesting user matches name of the user
    // document. The wildcard expression {userId} makes the userId variable
    // available in rules.
    match /users/{userID} {
      function isOwner() {
        return request.auth != null && request.auth.uid == userID;
      }

      allow read: if isOwner();
      allow create: if isOwner()
        && (
          !('creationDate' in request.resource.data)
          || request.resource.data.creationDate is timestamp
        );
      allow update: if isOwner()
        && !request.resource.data.diff(resource.data).affectedKeys().hasAny([
          'creationDate'
        ]);
      allow delete: if false;
      
      // Legal Agreements (Write-Once / Monotonic)
      match /legal/agreements {
        allow read: if request.auth.uid == userID;
        
        function isValidLegalAgreement() {
           return request.resource.data.keys().hasOnly([
             'acceptedPrivacyPolicy', 
             'acceptedDataPolicy', 
             'acceptedTrackingPolicy', 
             'acceptedMarketingPolicy',
             'acceptedDiagnosticsPolicy', 
             'acceptedTos'
           ]) &&
           (request.resource.data.get('acceptedPrivacyPolicy', true) == true) &&
           (request.resource.data.get('acceptedDataPolicy', true) == true) &&
           (request.resource.data.get('acceptedTrackingPolicy', false) is bool) &&
           (request.resource.data.get('acceptedMarketingPolicy', false) is bool) &&
           (request.resource.data.get('acceptedDiagnosticsPolicy', true) == true) &&
           (request.resource.data.get('acceptedTos', true) == true);
        }

        allow create: if request.auth.uid == userID && isValidLegalAgreement();
        
        allow update: if request.auth.uid == userID 
          && request.resource.data.diff(resource.data).affectedKeys().hasOnly([
             'acceptedPrivacyPolicy', 
             'acceptedDataPolicy', 
             'acceptedTrackingPolicy', 
             'acceptedMarketingPolicy',
             'acceptedDiagnosticsPolicy', 
             'acceptedTos'
           ])
          && (request.resource.data.get('acceptedPrivacyPolicy', true) == true)
          && (request.resource.data.get('acceptedDataPolicy', true) == true)
          && (request.resource.data.get('acceptedTrackingPolicy', false) is bool)
          && (request.resource.data.get('acceptedMarketingPolicy', false) is bool)
          && (request.resource.data.get('acceptedDiagnosticsPolicy', true) == true)
          && (request.resource.data.get('acceptedTos', true) == true);
           
      }

      // Config Settings (Private / Owner Read-Write)
      match /config/settings {
         allow read, write: if request.auth.uid == userID;
      }

      // AI Insights Latest Snapshot (Private / Owner Read/Delete, fixed latest doc only)
      match /aiInsightsRequests/{requestID} {
         allow read: if request.auth.uid == userID && requestID == 'latest';
         allow delete: if request.auth.uid == userID && requestID == 'latest';
         allow create, update: if false;
      }

      // AI Insights Usage (Private / Server-Owned only)
      match /aiInsightsUsage/{periodDocId} {
         allow read: if false;
         allow write: if false;
      }

      // System Status (Admin Only)
      match /system/status {
         allow read: if request.auth.uid == userID;
         allow write: if false; // Only Cloud Functions (Admin SDK)
      }

        match /events/{eventID} {
          // RESTRICTED ACCESS: Must be owner AND have a valid role (Free, Basic, or PRO)
          // TEMPORARILY DISABLED FOR TESTING - Re-enable when ready to enforce paywall
          // allow read, write: if request.auth.uid == userID && isSubscribed();
          allow read: if request.auth.uid == userID;
          allow create: if false;
          allow update: if request.auth.uid == userID
            && !request.resource.data.diff(resource.data).affectedKeys().hasAny(['originalFile', 'originalFiles', 'isMerge', 'mergeType']);
          allow delete: if request.auth.uid == userID;


            // Restoring metaData inside events
            match /metaData/processing {
              allow read: if request.auth.uid == userID;
              // Processing metadata is server-owned (Cloud Functions/Admin SDK only).
              allow write: if false;
            }
            match /metaData/{document=**} {
              allow read: if request.auth.uid == userID;
            }

          }
          
          match /activities/{activityID} {
            // New Flat Activities Collection
            function isOwnEventRef(data) {
              return data.keys().hasAll(['eventID']) && (
                data.eventID is string &&
                exists(/databases/$(database)/documents/users/$(userID)/events/$(data.eventID))
              );
            }

            allow read: if request.auth.uid == userID;
            allow create: if false;
            allow delete: if false;
            allow update: if request.auth.uid == userID
              && !request.resource.data.diff(resource.data).affectedKeys().hasAny(['eventID', 'userID', 'eventStartDate', 'sourceActivityKey'])
              && isOwnEventRef(request.resource.data);
          }

        match /meta/{document=**} {
          allow read: if request.auth.uid == userID;
        }

        match /derivedMetrics/{document=**} {
          allow read: if request.auth.uid == userID;
          allow write: if false;
        }

        match /sleepSessions/{sleepSessionID} {
          allow read: if request.auth.uid == userID;
          allow write: if false;
        }

        match /sleepSyncState/{providerID} {
          allow read: if request.auth.uid == userID;
          allow write: if false;
        }
    }

    // AI Insights repaired prompt backlog (global / server-owned only)
    match /aiInsightsPromptRepairs/{docId} {
      allow read: if false;
      allow write: if false;
    }

    match /customers/{userID} {
      allow read: if request.auth.uid == userID;
      
      match /checkout_sessions/{id} {
        allow read, write: if request.auth.uid == userID;
      }
      match /subscriptions/{id} {
        allow read: if request.auth.uid == userID;
      }
      match /payments/{id} {
        allow read: if request.auth.uid == userID;
      }
    }
    
    match /products/{id} {
      allow read: if true;
      match /prices/{id} {
        allow read: if true;
      }
      match /tax_rates/{id} {
        allow read: if true;
      }
    }


    match /suuntoAppAccessTokens/{userID} {
      allow read, write: if request.auth.uid == userID && request.auth.token.firebase.sign_in_provider != 'anonymous';
       match /tokens/{document=**} {
          allow read, write: if request.auth.uid == userID && request.auth.token.firebase.sign_in_provider != 'anonymous';
       }
    }

    match /COROSAPIAccessTokens/{userID} {
      allow read, write: if request.auth.uid == userID && request.auth.token.firebase.sign_in_provider != 'anonymous';
       match /tokens/{document=**} {
          allow read, write: if request.auth.uid == userID && request.auth.token.firebase.sign_in_provider != 'anonymous';
       }
    }

    match /garminAPITokens/{userID} {
      allow read, write: if request.auth.uid == userID && request.auth.token.firebase.sign_in_provider != 'anonymous';
       match /tokens/{document=**} {
          allow read, write: if request.auth.uid == userID && request.auth.token.firebase.sign_in_provider != 'anonymous';
       }
    }

    match /garminAPIActivityQueue/{userID} {
      allow read: if isAdmin();
      allow write: if false;
    }

    match /COROSAPIWorkoutQueue/{userID} {
      allow read: if isAdmin();
      allow write: if false;
    }

    match /suuntoAppWorkoutQueue/{userID} {
      allow read: if isAdmin();
      allow write: if false;
    }

    match /activitySyncQueue/{queueItemID} {
      allow read: if isAdmin();
      allow write: if false;
    }

    match /sleepSyncQueue/{queueItemID} {
      allow read: if isAdmin();
      allow write: if false;
    }


    match /failed_jobs/{document=**} {
      allow read: if isAdmin();
      allow write: if false;
    }
    
    match /changelogs/{docId} {
      allow read: if resource.data.published == true || isAdmin();
      allow write: if isAdmin();
    }
  }
}

service firebase.storage {
  match /b/{bucket}/o {
    match /assets/{allPaths=**} {
       allow read;
    }
  }
}