firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    function isAdmin() {
      return request.auth != null
        && request.auth.token.email != null
        && request.auth.token.email.matches('.*@snapsign\\.com\\.au$');
    }

    // Admin config documents (written by the admin portal)
    match /admin/{docId} {
      allow read, create, update, delete: if isAdmin();
    }

    // Allow users to read only their own usage docs
    match /usage_docs/{docId} {
      allow read: if request.auth != null && request.auth.uid == resource.data.uid;
      // Deny all client writes - only functions can write
      allow create, update, delete: if false;
    }

    // Allow users to create their own usage events (functions will handle creation)
    match /usage_events/{docId} {
      // Deny client writes - only functions can write
      allow create, read, update, delete: if false;
    }

    // Admin-only AI event feed (written by Cloud Functions).
    match /admin_ai_events/{docId} {
      allow read: if isAdmin();
      allow create, update, delete: if false;
    }

    // Unified admin reports feed (backend exceptions + user feedback/bug reports).
    match /admin_reports/{docId} {
      allow read, update, delete: if isAdmin();
      allow create: if false;
    }
  }
}