firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    
    // Users collection - users can only access their own profile
    match /users/{userId} {
      allow read, write: if request.auth != null && request.auth.uid == userId;
    }
    
    // Documents collection - users can only access their own documents
    match /users/{userId}/documents/{documentId} {
      allow read, write, delete: if request.auth != null && request.auth.uid == userId;
    }
    
    // Optimization versions - users can only access their own versions
    match /users/{userId}/optimizationVersions/{versionId} {
      allow read, write, delete: if request.auth != null && request.auth.uid == userId;
    }

    // Usage stats - users can only access their own stats
    // Document ID format: {userId}_{YYYY-MM}
    match /usage_stats/{statsId} {
      allow create: if request.auth != null && 
                       request.resource.data.userId == request.auth.uid &&
                       statsId.matches('^' + request.auth.uid + '_[0-9]{4}-[0-9]{2}$');
      allow read, update: if request.auth != null && 
                             statsId.matches('^' + request.auth.uid + '_[0-9]{4}-[0-9]{2}$');
      allow delete: if request.auth != null && 
                       resource.data.userId == request.auth.uid;
    }

    // Bug Reports collection - any authenticated user can create reports, admin can read/delete
    match /bugReports/{reportId} {
      allow create: if request.auth != null;
      allow read, write, delete: if request.auth != null && 
                                    request.auth.token.email in ['ayersdecker@gmail.com', 'eclipse12895@gmail.com'];
    }
    
    // Deny all other access by default
    match /{document=**} {
      allow read, write: if false;
    }
  }
}