firestore.rules

rules_version = '2';

service cloud.firestore {
  match /databases/{database}/documents {
    // Licenses collection - read only for validation, no client writes
    match /licenses/{licenseId} {
      // Anyone can check if a license exists (for validation)
      allow read: if true;
      // No client-side writes - only admin SDK or console
      allow write: if false;
    }

    // License activations - track usage
    match /activations/{activationId} {
      // Can create activation (one-time use validation)
      allow create: if request.resource.data.keys().hasAll(['licenseKey', 'activatedAt', 'deviceId']);
      // Can read own activation by device
      allow read: if true;
      // No updates or deletes from client
      allow update, delete: if false;
    }
  }
}