firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    
    // Helper functions
    function isAuthenticated() {
      return request.auth != null;
    }
    
    function isOwner(userId) {
      return isAuthenticated() && request.auth.uid == userId;
    }
    
    // Users collection
    match /users/{userId} {
      // Anyone authenticated can read user profiles
      allow read: if isAuthenticated();
      
      // Only the user can create/update/delete their own profile
      allow create: if isOwner(userId);
      allow update: if isOwner(userId);
      allow delete: if isOwner(userId);
    }
    
    // Groups collection
    match /groups/{groupId} {
      // Anyone authenticated can read groups
      allow read: if isAuthenticated();
      
      // Any authenticated user can create a group (Relaxed for debugging)
      allow create: if isAuthenticated();
      
      // Only creator or admins can update the group
      allow update: if isAuthenticated() 
                    && (resource.data.creatorId == request.auth.uid 
                        || request.auth.uid in resource.data.admins);
      // allow update: if isAuthenticated();
      
      // Only creator can delete the group
      allow delete: if isAuthenticated() 
                    && resource.data.creatorId == request.auth.uid;
      // allow delete: if isAuthenticated();
    }
  }
}