firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    // 1. Global Safety Net
    match /{document=**} {
      allow read, write: if false;
    }

    // Common primitives
    function isSignedIn() {
      return request.auth != null;
    }

    function isOwner(userId) {
      return isSignedIn() && request.auth.uid == userId;
    }

    function isValidId(id) {
      return id is string && id.size() <= 128 && id.matches('^[a-zA-Z0-9_\\-]+$');
    }

    // 2. User Profiles match
    match /users/{userId} {
      allow read: if isOwner(userId);
      allow create: if isOwner(userId) 
        && request.resource.data.uid == userId
        && request.resource.data.email is string
        && request.resource.data.theme in ['light', 'dark']
        && request.resource.data.monthlyIncome is number;
      allow update: if isOwner(userId)
        && request.resource.data.uid == userId
        && request.resource.data.email == resource.data.email
        && request.resource.data.theme in ['light', 'dark']
        && request.resource.data.monthlyIncome is number;
      allow delete: if isOwner(userId);

      // Subcollections under users/{userId} are strictly owned by that user
      
      match /transactions/{transactionId} {
        allow read, write: if isOwner(userId);
      }

      match /budgets/{budgetId} {
        allow read, write: if isOwner(userId);
      }

      match /savingsGoals/{goalId} {
        allow read, write: if isOwner(userId);
      }

      match /notes/{noteId} {
        allow read, write: if isOwner(userId);
      }

      match /tasks/{taskId} {
        allow read, write: if isOwner(userId);
      }

      match /events/{eventId} {
        allow read, write: if isOwner(userId);
      }

      match /notifications/{notificationId} {
        allow read, write: if isOwner(userId);
      }
    }
  }
}