firestore.rules

rules_version = '2';

service cloud.firestore {
  match /databases/{database}/documents {

    // fires/ — public read for map display; writes only via Admin SDK (Cloud Functions)
    match /fires/{fireId} {
      allow read: if true;
      allow write: if false;

      // notifiedDevices sub-collection — Admin SDK only
      match /notifiedDevices/{deviceId} {
        allow read, write: if false;
      }
    }

    // devices/ — any client can register or update their own device record.
    // The deviceId is a randomly generated UUID stored only on the device —
    // acting as an unguessable secret. No client reads (farm location + FCM
    // token must not be readable by other clients).
    match /devices/{deviceId} {
      allow read:   if false;
      allow create, update: if request.resource.data.deviceId == deviceId
                            && request.resource.data.farmLat is number
                            && request.resource.data.farmLng is number;
      allow delete: if false;
    }

    // users/ — authenticated users can only access their own documents
    match /users/{userId} {
      allow read, write: if request.auth != null && request.auth.uid == userId;

      match /farmData/{doc} {
        allow read, write: if request.auth != null && request.auth.uid == userId;
      }
    }

    // scoringLogs/ — Admin SDK only; clients have no business reading these
    match /scoringLogs/{logId} {
      allow read, write: if false;
    }
  }
}