firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    // Anyone can read drugs (public catalog)
    match /drugs/{drugId} {
      allow read: if true;
      allow write: if false; // Only admins via console
    }

    // Agents collection: Bearer token authentication for MCP
    // Users can manage their own agents
    match /agents/{agentId} {
      // Users can read their own agents
      allow read: if request.auth != null &&
        resource.data.userId == request.auth.uid;

      // Users can create agents (via Cloud Function generateBearerToken)
      allow create: if request.auth != null &&
        request.resource.data.userId == request.auth.uid &&
        request.resource.data.keys().hasAll(['userId', 'name', 'bearerToken', 'createdAt', 'lastUsedAt']);

      // Users can update lastUsedAt timestamp
      allow update: if request.auth != null &&
        resource.data.userId == request.auth.uid &&
        request.resource.data.diff(resource.data).affectedKeys().hasOnly(['lastUsedAt']);

      // Users can delete their own agents
      allow delete: if request.auth != null &&
        resource.data.userId == request.auth.uid;
    }

    // Usage events: MCP server writes, users read their own
    match /usage_events/{eventId} {
      // Users can read their own events
      allow read: if request.auth != null &&
        resource.data.userId == request.auth.uid;

      // Allow MCP server to create events (validates bearer token first)
      // MCP server uses service account, not user auth
      allow create: if true;

      // No updates or deletes
      allow update, delete: if false;
    }

    // Active drugs: Per-agent state for drug effects
    // MCP server manages these, users can read their own
    match /active_drugs/{drugId} {
      // Users can read their own active drugs
      allow read: if request.auth != null &&
        resource.data.userId == request.auth.uid;

      // MCP server (service account) can write
      // Users cannot directly write
      allow write: if false;
    }

    // OAuth authorization codes: Temporary codes for OAuth flow
    // Cloud Functions manage these, users should not access directly
    match /oauth_codes/{codeId} {
      // No direct user access
      allow read, write: if false;
    }

    // OAuth registered clients: Dynamic client registration (RFC 7591)
    // Cloud Functions manage these via service account
    match /oauth_clients/{clientId} {
      // No direct user access - managed by Cloud Functions
      allow read, write: if false;
    }

    // Legacy api_keys collection: Deprecated, will be removed
    // Kept for backward compatibility during migration
    match /api_keys/{keyId} {
      allow read: if true;
      allow create: if false; // No new API keys
      allow update, delete: if false;
    }
  }
}