firestore.rules

rules_version = '2';

service cloud.firestore {
  match /databases/{database}/documents {

    // ---------------------------------------------------------------
    // Helper functions
    // ---------------------------------------------------------------
    function isAuthenticated() {
      return request.auth != null;
    }

    function isOwner(userId) {
      return isAuthenticated() && request.auth.uid == userId;
    }

    function isPendingUserOfCurrentAuth(pendingUserId) {
      return isAuthenticated()
        && request.auth.token.email != null
        && pendingUserId == "pending_" + hashing.sha256(request.auth.token.email.lower()).toHexString().lower();
    }

    function isMemberOrPending(memberIds) {
      return isAuthenticated() && (
        request.auth.uid in memberIds ||
        (
          request.auth.token.email != null &&
          ("pending_" + hashing.sha256(request.auth.token.email.lower()).toHexString().lower() in memberIds)
        )
      );
    }

    // exists() guard handles the case where the group doc is being created
    // in the same WriteBatch — get() would fail because the doc doesn't
    // exist yet in the committed database state.
    function isGroupActiveOrNew(groupId) {
      return !exists(/databases/$(database)/documents/groups/$(groupId))
             || get(/databases/$(database)/documents/groups/$(groupId)).data.get("status", "ACTIVE") != "ARCHIVED"
             || get(/databases/$(database)/documents/groups/$(groupId)).data.get("deletionRequested", false) == true;
    }

    // ---------------------------------------------------------------
    // Users
    // ---------------------------------------------------------------
    match /users/{userId} {
      allow read: if isAuthenticated();
      allow create, update: if isOwner(userId)
                             || isPendingUserOfCurrentAuth(userId)
                             || (isAuthenticated() && userId.matches('pending_.*') && request.resource.data.isPending == true);
      allow delete: if isOwner(userId)
                     || isPendingUserOfCurrentAuth(userId)
                     || (isAuthenticated() && userId.matches('pending_.*'));

      // Devices subcollection — only the owning user can manage their devices
      match /devices/{deviceId} {
        allow read, write: if isOwner(userId);
      }
    }

    // ---------------------------------------------------------------
    // Collection group queries
    // ---------------------------------------------------------------
    // The app queries collectionGroup("members") to find all groups
    // the current user belongs to (where userId == auth.uid).
    match /{path=**}/members/{memberId} {
      allow read: if isAuthenticated();
    }

    // ---------------------------------------------------------------
    // Groups
    // ---------------------------------------------------------------
    // DESIGN DECISION: Subcollection rules (members, expenses, contributions,
    // cash_withdrawals, subunits) intentionally use only isAuthenticated()
    // without group-level membership checks. Reasons:
    //   1. Group membership is enforced at app level (navigation + repository).
    //   2. Adding per-document membership reads would significantly increase
    //      Firestore read costs and introduce latency on every operation.
    //   3. The security boundary is auth-level (only signed-in users), not
    //      group-level. This is an accepted trade-off for this app's model.
    // Do NOT add group membership checks to subcollection rules without
    // evaluating the cost/performance impact first.
    match /groups/{groupId} {
      // Any authenticated user can read groups they're a member of
      // (membership enforced at app level; rule allows read for now)
      allow read: if isAuthenticated();
      allow create: if isAuthenticated();
      allow update: if isMemberOrPending(resource.data.memberIds)
                     && (resource.data.get("status", "ACTIVE") != "ARCHIVED" || request.resource.data.get("deletionRequested", false) == true);
      allow delete: if isMemberOrPending(resource.data.memberIds);

      // Members subcollection
      match /members/{memberId} {
        allow read: if isAuthenticated();
        allow create, update: if isAuthenticated() && isGroupActiveOrNew(groupId);
        allow delete: if isAuthenticated();
      }

      // Expenses subcollection
      match /expenses/{expenseId} {
        allow read: if isAuthenticated();
        allow create, update: if isAuthenticated() && isGroupActiveOrNew(groupId);
        allow delete: if isAuthenticated();
      }

      // Contributions subcollection
      match /contributions/{contributionId} {
        allow read: if isAuthenticated();
        allow create, update: if isAuthenticated() && isGroupActiveOrNew(groupId);
        allow delete: if isAuthenticated();
      }

      // Cash withdrawals subcollection
      match /cash_withdrawals/{withdrawalId} {
        allow read: if isAuthenticated();
        allow create, update: if isAuthenticated() && isGroupActiveOrNew(groupId);
        allow delete: if isAuthenticated();
      }

      // Subunits subcollection
      match /subunits/{subunitId} {
        allow read: if isAuthenticated();
        allow create, update: if isAuthenticated() && isGroupActiveOrNew(groupId);
        allow delete: if isAuthenticated();
      }

      // Settlements subcollection
      match /settlements/{settlementId} {
        allow read: if isAuthenticated();
        allow create, update: if isAuthenticated() && isGroupActiveOrNew(groupId);
        allow delete: if isAuthenticated();
      }

      // Nudges subcollection
      match /nudges/{nudgeId} {
        allow read: if isAuthenticated();
        allow create, update: if isAuthenticated() && isGroupActiveOrNew(groupId);
        allow delete: if isAuthenticated();
      }

      // Cash transfers subcollection
      match /cash_transfers/{transferId} {
        allow read: if isAuthenticated();
        allow create, update: if isAuthenticated() && isGroupActiveOrNew(groupId);
        allow delete: if isAuthenticated();
      }
    }
  }
}