From 21012993ddadb7a155b176a743596627260dfbbb Mon Sep 17 00:00:00 2001
From: bponders12-cell <bponders12@gmail.com>
Date: Tue, 1 Sep 2026 17:07:15 -0400
Subject: [PATCH] SECURITY: fix motorcycle delete rule and preserve ownership
 enforcement

---
 firestore.rules | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/firestore.rules b/firestore.rules
index 88a409e..301f337 100644
--- a/firestore.rules
+++ b/firestore.rules
@@ -28,9 +28,6 @@ service cloud.firestore {
         ]);
     }
 
-    // Firebase UID is the security boundary. Profile fields are explicitly
-    // allow-listed so clients cannot turn the account document into a secret
-    // or entitlement store.
     match /users/{userId} {
       allow create: if validUserCreate(userId);
       allow read: if ownsUser(userId);
@@ -48,8 +45,9 @@ service cloud.firestore {
       }
 
       match /motorcycles/{motorcycleId} {
-        allow read, write: if ownsUser(userId)
+        allow create, update: if ownsUser(userId)
           && request.resource.data.ownerId == userId;
+        allow read, delete: if ownsUser(userId);
       }
 
       match /trips/{tripId} {
@@ -65,8 +63,6 @@ service cloud.firestore {
       }
     }
 
-    // Future collaborative resources must get explicit membership/field-level
-    // authorization before they are exposed.
     match /groupRides/{groupRideId} {
       allow read, write: if false;
     }