From 38dc8bfc146686eb495ff1f6f01c286042bd46c5 Mon Sep 17 00:00:00 2001
From: bponders12-cell <bponders12@gmail.com>
Date: Tue, 1 Sep 2026 21:00:17 -0400
Subject: [PATCH] Harden Firestore ride ownership and stable identity rules

---
 firestore.rules | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/firestore.rules b/firestore.rules
index 301f337..b582f58 100644
--- a/firestore.rules
+++ b/firestore.rules
@@ -28,6 +28,19 @@ service cloud.firestore {
         ]);
     }
 
+    function validRideCreate(userId, rideId) {
+      return ownsUser(userId)
+        && request.resource.data.ownerId == userId
+        && request.resource.data.id == rideId;
+    }
+
+    function validRideUpdate(userId) {
+      return ownsUser(userId)
+        && resource.data.ownerId == userId
+        && request.resource.data.ownerId == resource.data.ownerId
+        && request.resource.data.id == resource.data.id;
+    }
+
     match /users/{userId} {
       allow create: if validUserCreate(userId);
       allow read: if ownsUser(userId);
@@ -35,7 +48,10 @@ service cloud.firestore {
       allow delete: if ownsUser(userId);
 
       match /rides/{rideId} {
-        allow read, write: if ownsUser(userId);
+        allow create: if validRideCreate(userId, rideId);
+        allow update: if validRideUpdate(userId);
+        allow read, delete: if ownsUser(userId) && resource.data.ownerId == userId;
+
         match /events/{eventId} {
           allow read, write: if ownsUser(userId);
         }