rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    function signedIn() {
      return request.auth != null;
    }

    function ownsUser(userId) {
      return signedIn() && request.auth.uid == userId;
    }

    function validUserCreate(userId) {
      return ownsUser(userId)
        && request.resource.data.id == userId
        && request.resource.data.keys().hasOnly([
          'id', 'username', 'displayName', 'profilePhotoUrl', 'avatarPreset', 'bio',
          'location', 'createdAt', 'updatedAt', 'privacySettings', 'preferences'
        ]);
    }

    function validUserUpdate(userId) {
      return ownsUser(userId)
        && request.resource.data.id == resource.data.id
        && request.resource.data.createdAt == resource.data.createdAt
        && request.resource.data.keys().hasOnly([
          'id', 'username', 'displayName', 'profilePhotoUrl', 'avatarPreset', 'bio',
          'location', 'createdAt', 'updatedAt', 'privacySettings', 'preferences'
        ]);
    }

    function validRideCreate(userId, rideId) {
      return ownsUser(userId)
        && request.resource.data.ownerId == userId
        && request.resource.data.id == rideId;
    }

    function validRideUpdate(userId) {
      return ownsUser(userId)
        && resource.data.ownerId == userId
        && request.resource.data.ownerId == resource.data.ownerId
        && request.resource.data.id == resource.data.id;
    }

    match /handles/{handle} {
      allow read: if signedIn();
      allow create: if signedIn()
        && request.resource.data.uid == request.auth.uid
        && request.resource.data.handle == handle;
      allow delete: if signedIn() && resource.data.uid == request.auth.uid;
      allow update: if false;
    }

    match /users/{userId} {
      allow create: if validUserCreate(userId);
      allow get: if signedIn();
      allow list: if ownsUser(userId);
      allow update: if validUserUpdate(userId);
      allow delete: if ownsUser(userId);

      match /rides/{rideId} {
        allow create: if validRideCreate(userId, rideId);
        allow update: if validRideUpdate(userId);
        // Listing is path-scoped to the authenticated owner. Individual
        // reads and deletes retain the persisted ownerId check.
        allow list: if ownsUser(userId);
        allow get, delete: if ownsUser(userId) && resource.data.ownerId == userId;

        match /events/{eventId} {
          allow read, write: if ownsUser(userId);
        }
        match /performance/{runId} {
          allow read, write: if ownsUser(userId);
        }
      }

      match /motorcycles/{motorcycleId} {
        allow create, update: if ownsUser(userId)
          && request.resource.data.ownerId == userId;
        allow read, delete: if ownsUser(userId);
      }

      match /trips/{tripId} {
        allow read, write: if ownsUser(userId);
      }

      match /events/{eventId} {
        allow read, write: if ownsUser(userId);
      }

      match /friends/{friendId} {
        allow read: if ownsUser(userId);
        allow write: if signedIn() && (request.auth.uid == userId || request.auth.uid == friendId);
      }

      match /friend_requests_incoming/{senderId} {
        allow read: if ownsUser(userId);
        allow create: if signedIn() && request.auth.uid == senderId && request.resource.data.receiverUid == userId;
        allow delete: if signedIn() && (request.auth.uid == userId || request.auth.uid == senderId);
      }

      match /friend_requests_outgoing/{receiverId} {
        allow read: if ownsUser(userId);
        allow create: if ownsUser(userId) && request.resource.data.receiverUid == receiverId;
        allow delete: if signedIn() && (request.auth.uid == userId || request.auth.uid == receiverId);
      }

      match /blocks/{blockedId} {
        allow read, write: if ownsUser(userId);
      }
    }

    match /groupRides/{groupRideId} {
      allow read, write: if false;
    }

    match /{document=**} {
      allow read, write: if false;
    }
  }
}