firestore.rules

/**
 * @fileOverview Firestore Security Rules for SmartBytes application.
 *
 * Core Philosophy:
 * This ruleset enforces a strict user-ownership model for all data. Each user has full control over their own data, and no access to other users' data.
 *
 * Data Structure:
 * - /users/{userId}: Stores user profile information.
 * - /users/{userId}/watchlist/{watchlistId}: Stores a user's watchlist.
 * - /users/{userId}/history/{historyId}: Stores a user's watch history.
 * - /users/{userId}/ratings/{contentId}: Stores user ratings.
 * - /users/{userId}/favoriteActors/{actorId}: Stores a user's favorite actors.
 *
 * Key Security Decisions:
 * - Users can only access their own data, enforced through the `isOwner(userId)` function.
 * - Listing other users' data is disallowed.
 * - No global admin roles are defined in this prototype.
 */
rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {

    /**
     * @description Controls access to user profile information.
     * @path /databases/{database}/documents/users/{userId}
     * @allow (create) - User with ID 'user123' can create their profile.
     *    Request: auth.uid = 'user123', resource.data.id = 'user123'
     * @allow (get, update, delete) - User with ID 'user123' can read, update, and delete their profile.
     *    Request: auth.uid = 'user123'
     * @deny (create) - User with ID 'user456' cannot create a profile for 'user123'.
     *    Request: auth.uid = 'user456', resource.data.id = 'user123'
     * @deny (get, update, delete) - User with ID 'user456' cannot read, update, or delete 'user123' profile.
     *    Request: auth.uid = 'user456'
     * @principle Enforces document ownership for all operations on user profiles.
     */
    match /users/{userId} {
      function isOwner(userId) {
        return request.auth != null && request.auth.uid == userId;
      }

      function isExistingOwner(userId) {
          return isOwner(userId) && resource != null;
      }

      function isAdmin() {
        return request.auth != null && get(/databases/$(database)/documents/users/$(request.auth.uid)).data.isAdmin == true;
      }

      allow get: if isOwner(userId) || isAdmin();
      allow list: if isAdmin();
      allow create: if isOwner(userId) && request.resource.data.id == userId;
      allow update: if (isExistingOwner(userId) && request.resource.data.id == resource.data.id) || isAdmin();
      allow delete: if isExistingOwner(userId) || isAdmin();
    }

    /**
     * @description Controls access to user watchlist.
     * @path /databases/{database}/documents/users/{userId}/watchlist/{watchlistId}
     * @allow (create, get, list, update, delete) - User with ID 'user123' can manage their watchlist.
     *    Request: auth.uid = 'user123'
     * @deny (create, get, list, update, delete) - User with ID 'user456' cannot access 'user123' watchlist.
     *    Request: auth.uid = 'user456'
     * @principle Restricts watchlist access to the owning user.
     */
    match /users/{userId}/watchlist/{watchlistId} {
       function isOwner(userId) {
        return request.auth != null && request.auth.uid == userId;
      }

       function isExistingOwner(userId) {
          return isOwner(userId) && resource != null;
      }

      allow get: if isOwner(userId);
      allow list: if isOwner(userId);
      allow create: if isOwner(userId);
      allow update: if isExistingOwner(userId);
      allow delete: if isExistingOwner(userId);
    }

    /**
     * @description Controls access to user watch history.
     * @path /databases/{database}/documents/users/{userId}/history/{historyId}
     * @allow (create, get, list, update, delete) - User with ID 'user123' can manage their watch history.
     *    Request: auth.uid = 'user123'
     * @deny (create, get, list, update, delete) - User with ID 'user456' cannot access 'user123' watch history.
     *    Request: auth.uid = 'user456'
     * @principle Restricts watch history access to the owning user.
     */
    match /users/{userId}/history/{historyId} {
       function isOwner(userId) {
        return request.auth != null && request.auth.uid == userId;
      }

       function isExistingOwner(userId) {
          return isOwner(userId) && resource != null;
      }

      allow get: if isOwner(userId);
      allow list: if isOwner(userId);
      allow create: if isOwner(userId);
      allow update: if isExistingOwner(userId);
      allow delete: if isExistingOwner(userId);
    }

    /**
     * @description Controls access to user ratings.
     * @path /databases/{database}/documents/users/{userId}/ratings/{contentId}
     * @allow (create, get, list, update, delete) - User with ID 'user123' can manage their ratings.
     *    Request: auth.uid = 'user123'
     * @deny (create, get, list, update, delete) - User with ID 'user456' cannot access 'user123' ratings.
     *    Request: auth.uid = 'user456'
     * @principle Restricts rating access to the owning user.
     */
    match /users/{userId}/ratings/{contentId} {
       function isOwner(userId) {
        return request.auth != null && request.auth.uid == userId;
      }

      function isExistingOwner(userId) {
          return isOwner(userId) && resource != null;
      }

      allow get: if isOwner(userId);
      allow list: if isOwner(userId);
      allow create: if isOwner(userId);
      allow update: if isExistingOwner(userId);
      allow delete: if isExistingOwner(userId);
    }

    /**
     * @description Controls access to user's favorite actors.
     * @path /databases/{database}/documents/users/{userId}/favoriteActors/{actorId}
     * @allow (create, get, list, update, delete) - User with ID 'user123' can manage their favorite actors.
     *    Request: auth.uid = 'user123'
     * @deny (create, get, list, update, delete) - User with ID 'user456' cannot access 'user123' favorite actors.
     *    Request: auth.uid = 'user456'
     * @principle Restricts favorite actor access to the owning user.
     */
    match /users/{userId}/favoriteActors/{actorId} {
       function isOwner(userId) {
        return request.auth != null && request.auth.uid == userId;
      }

       function isExistingOwner(userId) {
          return isOwner(userId) && resource != null;
      }

      allow get: if isOwner(userId);
      allow list: if isOwner(userId);
      allow create: if isOwner(userId);
      allow update: if isExistingOwner(userId);
      allow delete: if isExistingOwner(userId);
    }

    /**
     * @description Controls access to global content cache collections.
     * These collections store TMDB data to improve performance and reduce API calls.
     * @path /databases/{database}/documents/movies/{movieId}
     * @path /databases/{database}/documents/tvShows/{tvShowId}
     * @path /databases/{database}/documents/persons/{personId}
     * @path /databases/{database}/documents/searchCache/{searchQuery}
     * @allow (get, list) - Anyone can read cached content data
     * @allow (create, update, delete) - Server-side operations for cache management
     * @principle Public read access for performance, controlled write access for cache integrity
     */
    match /movies/{movieId} {
      allow read: if true;
      allow write: if false; // Server-side cache management only
    }

    match /tvShows/{tvShowId} {
      allow read: if true;
      allow write: if false; // Server-side cache management only

      match /seasons/{seasonNumber} {
        allow read: if true;
        allow write: if false; // Server-side cache management only
      }
    }

    match /persons/{personId} {
      allow read: if true;
      allow write: if false; // Server-side cache management only
    }

    match /searchCache/{searchQuery} {
      allow read: if true;
      allow write: if false; // Server-side cache management only
    }

    match /genreCache/{type} {
      allow read: if true;
      allow write: if false; // Server-side cache management only
    }

    match /popularMovies/{movieId} {
      allow read: if true;
      allow write: if false; // Server-side cache management only
    }

    match /trendingMovies/{movieId} {
      allow read: if true;
      allow write: if false; // Server-side cache management only
    }

    match /popularTVShows/{showId} {
      allow read: if true;
      allow write: if false; // Server-side cache management only
    }

    match /trendingTVShows/{showId} {
      allow read: if true;
      allow write: if false; // Server-side cache management only
    }

    match /system/{docId} {
      function isAdmin() {
        return request.auth != null && get(/databases/$(database)/documents/users/$(request.auth.uid)).data.isAdmin == true;
      }

      allow read: if docId == 'projectSettings' || isAdmin();
      allow write: if isAdmin();
    }
  }
}