firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    // Allow authenticated users to read/write their own operations
    match /operations/{operationId} {
      allow read, write: if request.auth != null && request.auth.uid == resource.data.userId;
      allow create: if request.auth != null && request.auth.uid == request.resource.data.userId;
      
      // Allow access to operation messages subcollection
      match /messages/{messageId} {
        allow read, write: if request.auth != null && get(/databases/$(database)/documents/operations/$(operationId)).data.userId == request.auth.uid;
      }
    }
    
    // Allow authenticated users to read/write test documents (for debugging)
    match /test/{testId} {
      allow read, write: if request.auth != null;
    }
  }
}