rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /users/{userId} {
      allow read: if request.auth != null;
      allow write: if request.auth != null && request.auth.uid == userId;
    }
    match /users/{userId}/bookmarks/{id} {
      allow read, write: if request.auth != null && request.auth.uid == userId;
    }
    match /users/{userId}/notes/{id} {
      allow read, write: if request.auth != null && request.auth.uid == userId;
    }
    match /chat/{doc=**} {
      allow read, write: if request.auth != null;
    }
    match /feedback/{doc=**} {
      allow read, write: if request.auth != null;
    }
    match /notifications/{id} {
      allow read: if request.auth != null;
      allow write: if false;
    }
    match /chatGroups/{groupId} {
      allow read: if request.auth != null;
      allow write: if false;
      match /members/{userId} {
        allow read: if request.auth != null && request.auth.uid == userId;
        allow write: if false;
      }
      match /messages/{messageId} {
        // ANY signed-in user may submit (create) — enables the Contact Admin form.
        allow create: if request.auth != null;
        // Only group members may read messages — enforces write-only for non-members.
        allow read: if request.auth != null &&
          exists(/databases/$(database)/documents/chatGroups/$(groupId)/members/$(request.auth.uid));
        allow update, delete: if false;
      }
    }

    // RSVP — 4th of July Cookout
    // Any signed-in user can read all RSVPs (needed for the live tally).
    // Each user can only write their own RSVP document.
    match /events/{eventId}/rsvps/{userId} {
      allow read: if request.auth != null;
      allow create, update: if request.auth != null
                           && request.auth.uid == userId;
      allow delete: if false;
    }
  }
}