firestore.rules

rules_version = '2';

service cloud.firestore {
  match /databases/{database}/documents {

  // Helper function to check for organizer role
    function isOrganizer() {
      return request.auth.token.isOrganizer == true;
    }

    // Organizers have full admin access to EVERYTHING
    match /{document=**} {
      allow read, write: if isOrganizer();
    }

    match /users/{userId} {
      // Only the authenticated user can read or write their own data.
      allow read, write: if request.auth.uid == userId;
    }

    match /teams/{teamId} {
      // Team members can read the entire team document.
      allow read: if request.auth.uid in resource.data.memberIds;

      // Prevent members from creating or deleting teams (only organizers can do that via the global rule)
      allow create, delete: if false; 
    }

    match /event/{eventId} {
      // Anyone can read event data.
      allow read: if true;
    }
  }
}