firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    // Helper function to check if the user is authenticated
    function isAuth() {
      return request.auth != null;
    }
    
    // -------------------------
    // Users Collection
    // -------------------------
    match /users/{userId} {
      // Anyone authenticated can read user profiles (needed for search and community)
      allow read: if isAuth();
      // Only the user can write to their own main document
      allow write: if isAuth() && request.auth.uid == userId;
      
      // User Data Subcollections (e.g., profile, schedule)
      match /data/{docId} {
        // Publicly readable so others can view profiles
        allow read: if isAuth(); 
        allow write: if isAuth() && request.auth.uid == userId;
      }
      
      // Workouts
      match /workouts/{workoutId} {
        // Anyone can read (frontend filters visibility/friendship)
        allow read: if isAuth(); 
        allow write: if isAuth() && request.auth.uid == userId;
      }
      
      // Sessions (Workout History)
      match /sessions/{sessionId} {
        // Only the user can read and write their own history
        allow read, write: if isAuth() && request.auth.uid == userId;
      }
      
      // Friends Subcollection
      match /friends/{friendId} {
        // Anyone authenticated can check friends list
        allow read: if isAuth();
        // Only the user (or backend operations) can write to their friends list
        allow write: if isAuth() && request.auth.uid == userId;
      }
    }
    
    // -------------------------
    // Friend Requests Collection
    // -------------------------
    match /friendRequests/{requestId} {
      allow get: if isAuth() && (resource == null || resource.data.from == request.auth.uid || resource.data.to == request.auth.uid);
      allow list: if isAuth() && (resource.data.from == request.auth.uid || resource.data.to == request.auth.uid);
      
      // Users can create a request if they are the sender
      allow create: if isAuth() && request.resource.data.from == request.auth.uid;
      
      // Users can update if they are the receiver (e.g. to accept/reject)
      allow update: if isAuth() && resource.data.to == request.auth.uid;
      
      // Users can delete if they are either sender or receiver
      allow delete: if isAuth() && (resource.data.from == request.auth.uid || resource.data.to == request.auth.uid);
    }
  }
}