rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    function signedIn() {
      return request.auth != null;
    }

    function ownsUser(userId) {
      return signedIn() && request.auth.uid == userId;
    }

    // Every user-owned document is isolated by the Firebase UID. Cloudflare R2
    // is protected separately by the Worker using the same Firebase ID token.
    match /users/{userId} {
      allow read, write: if ownsUser(userId);

      match /rides/{rideId} {
        allow read, write: if ownsUser(userId);
        match /events/{eventId} {
          allow read, write: if ownsUser(userId);
        }
        match /performance/{runId} {
          allow read, write: if ownsUser(userId);
        }
      }

      match /motorcycles/{motorcycleId} {
        allow read, write: if ownsUser(userId);
      }

      match /trips/{tripId} {
        allow read, write: if ownsUser(userId);
      }

      match /events/{eventId} {
        allow read, write: if ownsUser(userId);
      }

      match /friends/{friendId} {
        allow read, write: if ownsUser(userId);
      }
    }

    // Future public/group collections must be added with explicit field-level
    // authorization. Do not use a global recursive wildcard here.
    match /groupRides/{groupRideId} {
      allow read, write: if false;
    }

    match /{document=**} {
      allow read, write: if false;
    }
  }
}