firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    // Helper function to check if user is authenticated
    function isAuthenticated() {
      return request.auth != null;
    }
    
    // Helper function to check if user owns the resource
    function isOwner(userId) {
      return isAuthenticated() && request.auth.uid == userId;
    }
    
    // Users collection - users can only read/write their own data
    match /users/{userId} {
      allow read, write: if isOwner(userId);
    }
    
    // Faces collection - users can only read/write their own faces
    match /faces/{faceId} {
      // Allow read if the face belongs to the authenticated user
      allow read: if isAuthenticated() && 
        (resource.data.userId == request.auth.uid || 
         resource.data.userId == 'default');
      
      // Allow create if the face is being created for the authenticated user
      allow create: if isAuthenticated() && 
        request.resource.data.userId == request.auth.uid;
      
      // Allow update/delete if the face belongs to the authenticated user
      allow update, delete: if isAuthenticated() && 
        resource.data.userId == request.auth.uid;
    }
    
    // Interactions collection - users can only read/write their own interactions
    match /interactions/{interactionId} {
      // Allow read if the interaction belongs to the authenticated user
      allow read: if isAuthenticated() && 
        resource.data.userId == request.auth.uid;
      
      // Allow create if the interaction is being created for the authenticated user
      allow create: if isAuthenticated() && 
        request.resource.data.userId == request.auth.uid;
      
      // Allow update/delete if the interaction belongs to the authenticated user
      allow update, delete: if isAuthenticated() && 
        resource.data.userId == request.auth.uid;
    }
  }
}