firestore.rules

rules_version = '2';

service cloud.firestore {
  match /databases/{database}/documents {

    // ── Users ──
    // Anyone authenticated can read user profiles (needed for search by uniqueId).
    // Only the owner can write their own profile.
    match /users/{userId} {
      allow read: if request.auth != null;
      allow write: if request.auth != null && request.auth.uid == userId;

      // ── Contacts subcollection ──
      // Only the owner can read/write their own contacts.
      match /contacts/{contactId} {
        allow read, write: if request.auth != null && request.auth.uid == userId;
      }
    }

    // ── Conversations ──
    // Participants can read and write their own conversations.
    // Creation is allowed for any authenticated user (both participants are set at creation).
    match /conversations/{convoId} {
      allow create: if request.auth != null;
      allow read, update: if request.auth != null
        && request.auth.uid in resource.data.participants;

      // ── Messages subcollection ──
      // Participants of the parent conversation can read/write messages.
      match /messages/{messageId} {
        allow read, write: if request.auth != null
          && request.auth.uid in get(/databases/$(database)/documents/conversations/$(convoId)).data.participants;
      }
    }

    // ── Groups (if using group chat) ──
    match /groups/{groupId} {
      allow create: if request.auth != null;
      allow read, update: if request.auth != null
        && request.auth.uid in resource.data.members;

      match /messages/{messageId} {
        allow read, write: if request.auth != null
          && request.auth.uid in get(/databases/$(database)/documents/groups/$(groupId)).data.members;
      }
    }
  }
}