firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {

    // User records: users may read their own record; only Cloud Functions
    // (Admin SDK, bypasses rules) write roles.
    match /users/{userId} {
      allow read: if request.auth != null
                  && (request.auth.uid == userId || request.auth.token.role == 'CEO');
      allow write: if false;
    }

    // Encrypted NIN/BVN ciphertext (§6.2) — server-only.
    // Reads happen exclusively through the decryptIdentity callable.
    match /identity/{aggregatorId} {
      allow read, write: if false;
    }

    // Device secret hashes (§6.1) — server-only.
    match /device_secrets/{deviceId} {
      allow read, write: if false;
    }

    // Audit logs (§6.2) — CEO may read; only Cloud Functions write.
    match /audit_logs/{logId} {
      allow read: if request.auth != null && request.auth.token.role == 'CEO';
      allow write: if false;
    }

    match /{document=**} {
      allow read, write: if false;
    }
  }
}