firestore.rules

rules_version = '2';

service cloud.firestore {
  match /databases/{database}/documents {

    // ── postbox collection ──────────────────────────────────────────────────
    // Authenticated users may read postbox data. Only server-side (Cloud
    // Functions admin SDK) may write postbox documents.
    match /postbox/{postboxId} {
      allow read: if request.auth != null;
      allow write: if false;
    }

    // ── claims collection ───────────────────────────────────────────────────
    // Claims are written exclusively by Cloud Functions (admin SDK).
    // Authenticated users may read their own claims only.
    match /claims/{claimId} {
      allow read: if request.auth != null && resource.data.userid == request.auth.uid;
      allow write: if false;
    }

    // ── users collection ────────────────────────────────────────────────────
    // Profile fields (displayName, streak, lastClaimDate, createdAt) are
    // written exclusively by Cloud Functions (Admin SDK) — this prevents
    // clients from bypassing the profanity filter by writing displayName
    // directly. The friends array is the only field clients may modify.
    match /users/{uid} {
      allow read: if request.auth != null;
      // Only the friends array may be updated by the owning user.
      allow update: if request.auth != null && request.auth.uid == uid
        && request.resource.data.diff(resource.data).affectedKeys().hasOnly(['friends']);
      // Create and all other writes are handled by Cloud Functions.
      allow create: if false;
    }

    // ── leaderboards collection ─────────────────────────────────────────────
    // Leaderboard documents are written by Cloud Functions only.
    // Authenticated users may read them.
    match /leaderboards/{period} {
      allow read: if request.auth != null;
      allow write: if false;
    }

  }
}