SentientAIBrowser/firestore.rules at feature-proxy · chicanoandres702/SentientAIBrowser · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {

    // Helper function to check if user is authenticated
    function isAuthenticated() {
      return request.auth != null;
    }

    // Helper to check if the document belongs to the signed-in user
    function isOwner(userId) {
      return request.auth.uid == userId;
    }

    // User Settings: Each user owns their own document (keyed by uid)
    match /users/{userId} {
      allow read, write: if isAuthenticated() && isOwner(userId);
    }

    // Survey Memory rules: Users can read all (sharing intelligence),
    // but only write/update their own entries or increment weights.
    match /survey_memory/{document} {
      allow read: if isAuthenticated();
      allow create: if isAuthenticated();
      allow update: if isAuthenticated();
    }

    // Thoughts rules: Strictly user-scoped for privacy
    match /thoughts/{document} {
      allow read: if isAuthenticated() && isOwner(resource.data.userId);
      allow create: if isAuthenticated() && isOwner(request.resource.data.userId);
      allow update, delete: if isAuthenticated() && isOwner(resource.data.userId);
    }

    // Task Queue rules: Strictly user-scoped
    match /task_queues/{document} {
      allow read: if isAuthenticated() && (resource == null || isOwner(resource.data.userId));
      allow write, delete: if isAuthenticated() && (resource == null || isOwner(resource.data.userId));
    }

    // Browser Tabs: Sync across devices
    match /browser_tabs/{document} {
      allow read: if isAuthenticated() && (resource == null || isOwner(resource.data.userId));
      allow create: if isAuthenticated() && isOwner(request.resource.data.userId);
      allow update: if isAuthenticated() && isOwner(resource.data.userId) && isOwner(request.resource.data.userId);
      allow delete: if isAuthenticated() && (resource == null || isOwner(resource.data.userId));
    }

    // Missions: Persistent AI missions
    match /missions/{document} {
      allow read: if isAuthenticated() && isOwner(resource.data.userId);
      allow write: if isAuthenticated() && (resource == null || isOwner(resource.data.userId)) && isOwner(request.resource.data.userId);
    }

    // Routines: Saved browser workflows
    match /routines/{document} {
      allow read: if isAuthenticated() && isOwner(resource.data.userId);
      allow write: if isAuthenticated() && (resource == null || isOwner(resource.data.userId)) && isOwner(request.resource.data.userId);
    }

    // User Sessions: Presence and status
    match /user_sessions/{documentId} {
      allow read: if isAuthenticated() && isOwner(documentId);
      allow write: if isAuthenticated() && isOwner(documentId);
    }

    // Mission Outcomes: Individual learning
    match /mission_outcomes/{document} {
      allow read: if isAuthenticated() && isOwner(resource.data.userId);
      allow write: if isAuthenticated() && (resource == null || isOwner(resource.data.userId)) && isOwner(request.resource.data.userId);
    }

    // Global Knowledge: Anonymous shared learning
    match /global_knowledge/{document} {
      allow read: if isAuthenticated();
      allow create: if isAuthenticated();
      allow update, delete: if false;
    }

    // User Knowledge: Universal hierarchical context (Private)
    match /user_knowledge/{document} {
      allow read: if isAuthenticated() && isOwner(resource.data.userId);
      allow write: if isAuthenticated() && (resource == null || isOwner(resource.data.userId)) && isOwner(request.resource.data.userId);
    }
  }
}