Closer/firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {

    // ── Helpers ──────────────────────────────────────────────────────────────

    function isSignedIn() {
      return request.auth != null;
    }

    function isOwner(uid) {
      return isSignedIn() && request.auth.uid == uid;
    }

    function isCouplesMember(coupleId) {
      return isSignedIn()
        && request.auth.uid in
           get(/databases/$(database)/documents/couples/$(coupleId)).data.userIds;
    }

    // ── Users ─────────────────────────────────────────────────────────────────
    // Each user owns exactly their own document.
    // hasPremium is server-only: clients may not write it directly.

    match /users/{uid} {
      allow read: if isOwner(uid);
      allow create: if isOwner(uid)
        && !request.resource.data.keys().hasAny(['hasPremium']);
      allow update: if isOwner(uid)
        && !request.resource.data.diff(resource.data).affectedKeys().hasAny(['hasPremium']);
    }

    // ── Invite codes ──────────────────────────────────────────────────────────
    // Any authenticated user can create or read an invite code.
    // Only status + acceptor fields may be updated (no re-writing the code).

    match /invites/{code} {
      allow read:   if isSignedIn();
      allow create: if isSignedIn();
      allow update: if isSignedIn()
        && resource.data.status == 'pending'
        && request.resource.data.keys().hasOnly(
             ['status', 'acceptorUserId', 'acceptedAt', 'coupleId']);
    }

    // ── Couples ───────────────────────────────────────────────────────────────
    // Only the two members of a couple may read or write couple data.

    match /couples/{coupleId} {
      allow read, write: if isCouplesMember(coupleId);

      match /sessions/{sessionId} {
        allow read, write: if isCouplesMember(coupleId);
      }

      // Question threads live under the couple document.
      match /question_threads/{threadId} {
        allow read, write: if isCouplesMember(coupleId);

        // Answers: each user writes their own; both members can read all answers.
        match /answers/{userId} {
          allow write:  if isOwner(userId);
          allow read:   if isCouplesMember(coupleId);
        }

        // Discussion messages: any couple member can write and read.
        match /messages/{messageId} {
          allow read, write: if isCouplesMember(coupleId);
        }

        // Reactions: any couple member can write and read.
        match /reactions/{reactionId} {
          allow read, write: if isCouplesMember(coupleId);
        }
      }
    }
  }
}