firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {

    // Default deny rule for any unmapped paths
    match /{document=**} {
      allow read, write: if false;
    }

    // Helper functions for security validation
    function isAuthenticated() {
      return request.auth != null;
    }

    function isOwner(uid) {
      return isAuthenticated() && request.auth.uid == uid;
    }

    // User document profile (/users/{uid})
    match /users/{uid} {
      allow read, write: if isOwner(uid);

      // User notes subcollection (/users/{uid}/notes/{noteId})
      match /notes/{noteId} {
        allow read, write, delete: if isOwner(uid);
      }

      // Active user sessions subcollection (/users/{uid}/sessions/{deviceId})
      match /sessions/{deviceId} {
        allow read, write, delete: if isOwner(uid);
      }
    }

    // Public notes collection (/public_notes/{noteId})
    // Shared notes are readable by anyone with the link.
    // Client-side modifications/deletions are blocked (managed via Cloudflare Worker Admin SDK).
    match /public_notes/{noteId} {
      allow read: if true;
      allow write: if false;
    }
  }
}