firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    // Activities collection - users can only read/write their own activities
    match /activities/{activityId} {
      allow read, write: if request.auth != null && 
                        (request.auth.uid == resource.data.sellerId ||
                         request.auth.uid == request.resource.data.sellerId);
      allow create: if request.auth != null && 
                   request.auth.uid == request.resource.data.sellerId;
    }
    
    // Listings collection
    match /listings/{listingId} {
      allow read: if true; // Anyone can read listings (for buyers)
      allow write: if request.auth != null && 
                   request.auth.uid == resource.data.user_id;
      allow create: if request.auth != null && 
                   request.auth.uid == request.resource.data.user_id;
    }
    
    // Users collection
    match /users/{userId} {
      allow read, write: if request.auth != null && request.auth.uid == userId;
    }
  }
}