firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    function isAuthenticated() {
      return request.auth != null;
    }

    function userOwns(ownerId) {
      return isAuthenticated() && ownerId != null && ownerId == request.auth.uid;
    }

    // Font families: owner-scoped reads. All writes go through Cloud Functions/admin.
    // Serving (css2/s/d) and search use the admin SDK and bypass rules.
    match /fontfamilies/{familyId} {
      allow read: if userOwns(resource.data.ownerId);
      allow write: if false;
    }

    // Batch tracking docs: admin-only writes; no client reads needed.
    match /batchJobs/{jobId} {
      allow read: if false;
      allow write: if false;
    }

    // User profile
    match /users/{userId} {
      allow read: if isAuthenticated() && userId == request.auth.uid;
      allow write: if false;
    }

    // Durable import records: owners can observe the batch tree; clients never write it.
    match /users/{userId}/importBatches/{batchId} {
      allow read: if isAuthenticated() && userId == request.auth.uid;
      allow write: if false;

      match /{document=**} {
        allow read: if isAuthenticated() && userId == request.auth.uid;
        allow write: if false;
      }
    }

    // Per-user ingest records
    match /users/{userId}/ingests/{ingestId} {
      allow read: if isAuthenticated() && userId == request.auth.uid;
      allow write: if false;
    }

    // Per-user batch ledgers
    match /users/{userId}/batches/{batchId} {
      allow read: if isAuthenticated() && userId == request.auth.uid;
      allow write: if false;
    }

    // Closed-beta invite list: Admin SDK / Cloud Functions only.
    match /betaAllowlist/{email} {
      allow read, write: if false;
    }

    // Deny everything else by default (no catch-all allow).
  }
}