firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    
    // MASTER ADMIN CHECK
    // Open-source note: replace these emails with the deployer's own admin emails.
    // (Kept as-is so the default admin gate continues to work in this repo.)
    function isAdmin() {
      return request.auth != null && (
        request.auth.token.email == 'stackapps.app@gmail.com'
      );
    } 

    match /staticPages/{pageId} {
      allow read: if true;
      allow write: if request.auth.token.admin == true;
    }                              

    // SHARED TRANSLATION ORACLE
    match /translationCache/{cacheId} {
      allow read: if true;
      allow create, update: if request.auth != null || isAdmin();
    }

    match /feedback/{feedbackId} {
      allow create: if request.auth != null;
      allow read, update, delete: if isAdmin();
    }   

    // CENTRALIZED CONFIG
    match /stackapps_config/{docId} {
      allow read: if request.auth != null;
      allow write: if isAdmin();
    }

    // ENTITLEMENTS - users read their own; admins read/write all
    match /stackapps_entitlements/{userId} {
      allow read: if (request.auth != null && request.auth.uid == userId) || isAdmin();
      allow write: if isAdmin();
    }

    // APP REGISTRATIONS - admin read-only, backend service account writes
    match /stackapps_app_registrations/{docId} {
      allow read: if isAdmin();
      allow write: if false;
    }

    match /free_scans/{hostname} {
      allow get: if request.auth != null;
      allow list: if isAdmin();
      allow create, delete: if false;
      allow update: if request.auth != null
        && resource.data.converted != true
        && request.resource.data.converted == true;
    }

    match /admin_users/{uid} {
      allow read, write: if false;
    }

    // USER-CENTRIC HUB (StackSpent, StackStock, etc.)
    match /users/{userId}/{document=**} {
      allow read, write: if (request.auth != null && request.auth.uid == userId) || isAdmin();
    }

    // SOCIAL MARKETPLACE
    match /apps/{appId} {
      // Single document reads: approved, owner, or admin
      allow get: if resource.data.moderationStatus == 'approved'
                 || isAdmin()
                 || (request.auth != null && resource.data.ownerId == request.auth.uid);
      // Collection queries: open listing — The Stackhouse is a public marketplace.
      // Writes (create/update/delete) are secured below. Reads are unrestricted so that
      // both unauthenticated browsing and owner queries (where ownerId==uid) work without
      // Firestore's OR-condition query evaluation rejecting the listener.
      allow list: if true;
      allow create: if request.auth != null;
      allow update, delete: if isAdmin() || (request.auth != null && resource.data.ownerId == request.auth.uid);
    }

    // REVIEWS - users can read/write their own; approved app reviews are public
    match /reviews/{reviewId} {
      allow read: if true;
      allow create: if request.auth != null;
      allow update, delete: if isAdmin() || (request.auth != null && resource.data.userId == request.auth.uid);
    }

    // TOP-LEVEL COLLECTIONS (For your existing apps)
    match /products/{id} { allow read, write: if isAdmin() || (request.auth != null && resource.data.ownerId == request.auth.uid); }
    match /clients/{id} { allow read, write: if isAdmin() || (request.auth != null && resource.data.ownerId == request.auth.uid); }

    // GLOBAL METADATA
    match /app_metadata/{docId} {
      allow read: if request.auth != null;
      allow write: if isAdmin();
    }         
    
    // This covers /public_slips, /public_profiles, /public_reports, etc.
    match /{collectionName}/{docId} {
      allow read: if collectionName.matches('public_.*');
      allow write: if request.auth != null;
    }

    match /{document=**} { allow read, write: if false; }
  }
}