firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    function isAdmin() {
      return request.auth != null && request.auth.token.admin == true;
    }

    function isNonAnonymousOwner(userID) {
      return request.auth != null
        && request.auth.uid == userID
        && request.auth.token.firebase.sign_in_provider != 'anonymous';
    }

    function serviceDisconnectFields() {
      return [
        'disconnectState',
        'disconnectReason',
        'disconnectAttemptCount',
        'disconnectNextAttemptAt',
        'disconnectLastAttemptAt',
        'disconnectRetryExpiresAt',
        'disconnectLastStatusCode',
        'disconnectLastErrorMessage',
        'disconnectManualReviewRequired'
      ];
    }

    function serviceRootCreateDoesNotSetDisconnectFields() {
      return !request.resource.data.keys().hasAny(serviceDisconnectFields());
    }

    function serviceRootUpdateDoesNotTouchDisconnectFields() {
      return !request.resource.data.diff(resource.data).affectedKeys().hasAny(serviceDisconnectFields());
    }

    function serviceRootIsNotPendingDisconnect() {
      return !('disconnectState' in resource.data)
        || resource.data.disconnectState != 'disconnect_pending';
    }

    // Make sure the uid of the requesting user matches name of the user
    // document. The wildcard expression {userId} makes the userId variable
    // available in rules.
    match /users/{userID} {
      function isOwner() {
        return request.auth != null && request.auth.uid == userID;
      }

      allow read: if isOwner();
      allow create: if isOwner()
        && (
          !('creationDate' in request.resource.data)
          || request.resource.data.creationDate is timestamp
        );
      allow update: if isOwner()
        && !request.resource.data.diff(resource.data).affectedKeys().hasAny([
          'creationDate'
        ]);
      allow delete: if false;
      
      // Legal Agreements (Write-Once / Monotonic)
      match /legal/agreements {
        allow read: if request.auth.uid == userID;
        
        function isValidLegalAgreement() {
           return request.resource.data.keys().hasOnly([
             'acceptedPrivacyPolicy', 
             'acceptedDataPolicy', 
             'acceptedTrackingPolicy', 
             'acceptedMarketingPolicy',
             'acceptedDiagnosticsPolicy', 
             'acceptedTos'
           ]) &&
           (request.resource.data.get('acceptedPrivacyPolicy', true) == true) &&
           (request.resource.data.get('acceptedDataPolicy', true) == true) &&
           (request.resource.data.get('acceptedTrackingPolicy', false) is bool) &&
           (request.resource.data.get('acceptedMarketingPolicy', false) is bool) &&
           (request.resource.data.get('acceptedDiagnosticsPolicy', true) == true) &&
           (request.resource.data.get('acceptedTos', true) == true);
        }

        allow create: if request.auth.uid == userID && isValidLegalAgreement();
        
        allow update: if request.auth.uid == userID 
          && request.resource.data.diff(resource.data).affectedKeys().hasOnly([
             'acceptedPrivacyPolicy', 
             'acceptedDataPolicy', 
             'acceptedTrackingPolicy', 
             'acceptedMarketingPolicy',
             'acceptedDiagnosticsPolicy', 
             'acceptedTos'
           ])
          && (request.resource.data.get('acceptedPrivacyPolicy', true) == true)
          && (request.resource.data.get('acceptedDataPolicy', true) == true)
          && (request.resource.data.get('acceptedTrackingPolicy', false) is bool)
          && (request.resource.data.get('acceptedMarketingPolicy', false) is bool)
          && (request.resource.data.get('acceptedDiagnosticsPolicy', true) == true)
          && (request.resource.data.get('acceptedTos', true) == true);
           
      }

      // Config Settings (Private / Owner Read-Write). Training benchmarks are
      // deliberately server-owned so every selection is validated and queues
      // a targeted derived-metrics refresh through its App-Check callable.
      match /config/settings {
         allow read: if request.auth.uid == userID;
         allow create: if request.auth.uid == userID
           && !request.resource.data.keys().hasAny(['trainingSettings']);
         allow update: if request.auth.uid == userID
           && !request.resource.data.diff(resource.data).affectedKeys().hasAny(['trainingSettings']);
         allow delete: if request.auth.uid == userID
           && !resource.data.keys().hasAny(['trainingSettings']);
      }

      // AI Insights Latest Snapshot (Private / Owner Read/Delete, fixed latest doc only)
      match /aiInsightsRequests/{requestID} {
         allow read: if request.auth.uid == userID && requestID == 'latest';
         allow delete: if request.auth.uid == userID && requestID == 'latest';
         allow create, update: if false;
      }

      // AI Insights Usage (Private / Server-Owned only)
      match /aiInsightsUsage/{periodDocId} {
         allow read: if false;
         allow write: if false;
      }

      // Event merge operations contain server-owned idempotency and lease state.
      match /eventMergeOperations/{operationID} {
         allow read, write: if false;
      }

      // System Status (Admin Only)
      match /system/status {
         allow read: if request.auth.uid == userID;
         allow write: if false; // Only Cloud Functions (Admin SDK)
      }

        match /events/{eventID} {
          function isPublicEvent() {
            return resource.data.privacy == 'public';
          }

          function serverOwnedEventFields() {
            return [
              'originalFile',
              'originalFiles',
              'isMerge',
              'mergeType',
              'toolSource',
              'sourceFilesCount',
              'activitiesCount',
              'comparisonTitle',
              'benchmarkStatus',
              'privacy'
            ];
          }

          function isValidEventTag(tags, index) {
            return tags.size() <= index
              || (tags[index] is string
                && tags[index].size() > 0
                && tags[index].size() <= 32
                && tags[index].matches('^\\S+( \\S+)*$'));
          }

          function isValidEventTagList(tags) {
            return tags is list
              && tags.size() <= 10
              && tags.toSet().size() == tags.size()
              && isValidEventTag(tags, 0)
              && isValidEventTag(tags, 1)
              && isValidEventTag(tags, 2)
              && isValidEventTag(tags, 3)
              && isValidEventTag(tags, 4)
              && isValidEventTag(tags, 5)
              && isValidEventTag(tags, 6)
              && isValidEventTag(tags, 7)
              && isValidEventTag(tags, 8)
              && isValidEventTag(tags, 9);
          }

          function hasValidUpdatedEventTags() {
            let affectedKeys = request.resource.data.diff(resource.data).affectedKeys();
            return (!affectedKeys.hasAny(['tags'])
                || (request.resource.data.keys().hasAny(['tags'])
                  && isValidEventTagList(request.resource.data.tags))
                || (!request.resource.data.keys().hasAny(['tags'])
                  && (!request.resource.data.keys().hasAny(['benchmarkReviewTags'])
                    || isValidEventTagList(request.resource.data.benchmarkReviewTags))))
              && (!affectedKeys.hasAny(['benchmarkReviewTags'])
                || !request.resource.data.keys().hasAny(['benchmarkReviewTags'])
                || isValidEventTagList(request.resource.data.benchmarkReviewTags));
          }

          // RESTRICTED ACCESS: Must be owner AND have a valid role (Free, Basic, or PRO)
          // TEMPORARILY DISABLED FOR TESTING - Re-enable when ready to enforce paywall
          // allow read, write: if request.auth.uid == userID && isSubscribed();
          allow get: if isOwner() || isPublicEvent();
          allow list: if isOwner();
          allow create: if false;
          allow update: if request.auth.uid == userID
            && !request.resource.data.diff(resource.data).affectedKeys().hasAny(serverOwnedEventFields())
            && hasValidUpdatedEventTags();
          allow delete: if request.auth.uid == userID;


            // Restoring metaData inside events
            match /metaData/processing {
              allow read: if request.auth.uid == userID;
              // Processing metadata is server-owned (Cloud Functions/Admin SDK only).
              allow write: if false;
            }
            match /metaData/{document=**} {
              allow read: if request.auth.uid == userID;
            }

          }

        match /routes/{routeID} {
          function serverOwnedRouteFields() {
            return [
              'id',
              'userID',
              'originalFile',
              'originalFiles',
              'srcFileType',
              'sourceFileType',
              'creator',
              'createdAt',
              'importedAt',
              'updatedAt',
              'stats',
              'routes',
              'routeCount',
              'waypointCount',
              'pointCount',
              'activityTypes',
              'streamTypes',
              'bounds',
              'preview',
              'previewReady',
              'sourceSummary',
              'syncedDestinationServiceNames',
              'deliverySummaries'
            ];
          }

          function hasValidRouteName() {
            return request.resource.data.name is string
              && request.resource.data.name.size() > 0
              && request.resource.data.name.size() <= 120;
          }

          allow read: if request.auth.uid == userID;
          allow create: if false;
          allow update: if request.auth.uid == userID
            && !request.resource.data.diff(resource.data).affectedKeys().hasAny(serverOwnedRouteFields())
            && hasValidRouteName();
          allow delete: if request.auth.uid == userID;

          match /metaData/processing {
            allow read: if request.auth.uid == userID;
            allow write: if false;
          }
          match /metaData/{document=**} {
            allow read: if request.auth.uid == userID;
          }
        }
          
          match /activities/{activityID} {
            // New Flat Activities Collection
            function isOwnEventRef(data) {
              return data.keys().hasAll(['eventID']) && (
                data.eventID is string &&
                exists(/databases/$(database)/documents/users/$(userID)/events/$(data.eventID))
              );
            }

            function parentEventIsPublic(data) {
              return data.keys().hasAll(['eventID']) && (
                data.eventID is string &&
                get(/databases/$(database)/documents/users/$(userID)/events/$(data.eventID)).data.privacy == 'public'
              );
            }

            allow read: if request.auth.uid == userID || parentEventIsPublic(resource.data);
            allow create: if false;
            allow delete: if false;
            allow update: if request.auth.uid == userID
              && !request.resource.data.diff(resource.data).affectedKeys().hasAny(['eventID', 'userID', 'eventStartDate', 'sourceActivityKey'])
              && isOwnEventRef(request.resource.data);
          }

        match /meta/{document=**} {
          allow read: if request.auth.uid == userID;
        }

        match /derivedMetrics/{document=**} {
          allow read: if request.auth.uid == userID;
          allow write: if false;
        }

        match /sleepSessions/{sleepSessionID} {
          allow read: if request.auth.uid == userID;
          allow write: if false;
        }

        match /sleepSyncState/{providerID} {
          allow read: if request.auth.uid == userID;
          allow write: if false;
        }

        // MCP connection summaries and all credential state are server-owned.
        // The app uses authenticated, App-Check-protected callables to list
        // and revoke connections without exposing token material.
        match /mcpConnections/{connectionID} {
          allow read, write: if false;
        }
    }

    match /mcpOAuthAuthorizationRequests/{document=**} {
      allow read, write: if false;
    }

    match /mcpOAuthAuthorizationCodes/{document=**} {
      allow read, write: if false;
    }

    match /mcpOAuthAccessTokens/{document=**} {
      allow read, write: if false;
    }

    match /mcpOAuthRefreshTokens/{document=**} {
      allow read, write: if false;
    }

    match /mcpOAuthRateLimits/{document=**} {
      allow read, write: if false;
    }

    // AI Insights repaired prompt backlog (global / server-owned only)
    match /aiInsightsPromptRepairs/{docId} {
      allow read: if false;
      allow write: if false;
    }

    match /customers/{userID} {
      allow read: if request.auth.uid == userID;
      
      match /checkout_sessions/{id} {
        allow read, write: if request.auth.uid == userID;
      }
      match /subscriptions/{id} {
        allow read: if request.auth.uid == userID;
      }
      match /payments/{id} {
        allow read: if request.auth.uid == userID;
      }
    }
    
    match /products/{id} {
      allow read: if true;
      match /prices/{id} {
        allow read: if true;
      }
      match /tax_rates/{id} {
        allow read: if true;
      }
    }


    match /suuntoAppAccessTokens/{userID} {
      allow read: if isNonAnonymousOwner(userID);
      allow create: if isNonAnonymousOwner(userID)
        && serviceRootCreateDoesNotSetDisconnectFields();
      allow update: if isNonAnonymousOwner(userID)
        && serviceRootIsNotPendingDisconnect()
        && serviceRootUpdateDoesNotTouchDisconnectFields();
      allow delete: if isNonAnonymousOwner(userID)
        && serviceRootIsNotPendingDisconnect();
       match /tokens/{document=**} {
          allow read: if isNonAnonymousOwner(userID);
          allow write: if isNonAnonymousOwner(userID)
            && (
              !exists(/databases/$(database)/documents/suuntoAppAccessTokens/$(userID))
              || get(/databases/$(database)/documents/suuntoAppAccessTokens/$(userID)).data.disconnectState != 'disconnect_pending'
            );
       }
    }

    match /COROSAPIAccessTokens/{userID} {
      allow read: if isNonAnonymousOwner(userID);
      allow create: if isNonAnonymousOwner(userID)
        && serviceRootCreateDoesNotSetDisconnectFields();
      allow update: if isNonAnonymousOwner(userID)
        && serviceRootIsNotPendingDisconnect()
        && serviceRootUpdateDoesNotTouchDisconnectFields();
      allow delete: if isNonAnonymousOwner(userID)
        && serviceRootIsNotPendingDisconnect();
       match /tokens/{document=**} {
          allow read: if isNonAnonymousOwner(userID);
          allow write: if isNonAnonymousOwner(userID)
            && (
              !exists(/databases/$(database)/documents/COROSAPIAccessTokens/$(userID))
              || get(/databases/$(database)/documents/COROSAPIAccessTokens/$(userID)).data.disconnectState != 'disconnect_pending'
            );
       }
    }

    match /garminAPITokens/{userID} {
      allow read: if isNonAnonymousOwner(userID);
      allow create: if isNonAnonymousOwner(userID)
        && serviceRootCreateDoesNotSetDisconnectFields();
      allow update: if isNonAnonymousOwner(userID)
        && serviceRootIsNotPendingDisconnect()
        && serviceRootUpdateDoesNotTouchDisconnectFields();
      allow delete: if isNonAnonymousOwner(userID)
        && serviceRootIsNotPendingDisconnect();
       match /tokens/{document=**} {
          allow read: if isNonAnonymousOwner(userID);
          allow write: if isNonAnonymousOwner(userID)
            && (
              !exists(/databases/$(database)/documents/garminAPITokens/$(userID))
              || get(/databases/$(database)/documents/garminAPITokens/$(userID)).data.disconnectState != 'disconnect_pending'
            );
       }
    }

    // Wahoo OAuth credentials and provider identity mappings are server-owned.
    // The app reads safe connection state from users/{uid}/meta/Wahoo API.
    match /wahooAPIAccessTokens/{userID}/{document=**} {
      allow read, write: if false;
    }

    match /wahooAPIUserMappings/{document=**} {
      allow read, write: if false;
    }

    match /garminAPIActivityQueue/{userID} {
      allow read: if isAdmin();
      allow write: if false;
    }

    match /COROSAPIWorkoutQueue/{userID} {
      allow read: if isAdmin();
      allow write: if false;
    }

    match /suuntoAppWorkoutQueue/{userID} {
      allow read: if isAdmin();
      allow write: if false;
    }

    match /wahooAPIWorkoutQueue/{queueItemID} {
      allow read: if isAdmin();
      allow write: if false;
    }

    match /activitySyncQueue/{queueItemID} {
      allow read: if isAdmin();
      allow write: if false;
    }

    match /routeDeliverySyncQueue/{queueItemID} {
      allow read: if isAdmin();
      allow write: if false;
    }

    match /sleepSyncQueue/{queueItemID} {
      allow read: if isAdmin();
      allow write: if false;
    }


    match /failed_jobs/{document=**} {
      allow read: if isAdmin();
      allow write: if false;
    }
    
    match /changelogs/{docId} {
      allow read: if resource.data.published == true || isAdmin();
      allow write: if isAdmin();
    }
  }
}

service firebase.storage {
  match /b/{bucket}/o {
    match /assets/{allPaths=**} {
       allow read;
    }
  }
}