firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    // Default Deny
    match /{document=**} {
      allow read, write: if false;
    }

    //////////////////// Helper Functions ////////////////////

    function isSignedIn() {
      return request.auth != null;
    }

    function isOwner(userId) {
      return isSignedIn() && request.auth.uid == userId;
    }

    function incoming() {
      return request.resource.data;
    }

    function existing() {
      return resource.data;
    }

    function isValidString(val, maxLen) {
      return val is string && val.size() <= maxLen;
    }

    function isValidNumber(val) {
      return val is number;
    }

    function isValidId(id) {
      return id is string && id.size() <= 128 && id.matches('^[a-zA-Z0-9_\\-]+$');
    }

    function partnerDocPath(ownerId) {
      return /databases/$(database)/documents/users/$(ownerId)/partners/$(request.auth.uid);
    }

    function isAcceptedPartner(ownerId) {
      return isSignedIn() &&
             exists(partnerDocPath(ownerId)) &&
             get(partnerDocPath(ownerId)).data.status == 'accepted';
    }

    function isWritePartner(ownerId) {
      return isSignedIn() &&
             exists(partnerDocPath(ownerId)) &&
             get(partnerDocPath(ownerId)).data.status == 'accepted' &&
             get(partnerDocPath(ownerId)).data.permission == 'write';
    }

    function isAuthorizedReader(ownerId) {
      return isOwner(ownerId) || isAcceptedPartner(ownerId);
    }

    function isAuthorizedWriter(ownerId) {
      return isOwner(ownerId) || isWritePartner(ownerId);
    }

    //////////////////// Blueprint Validators ////////////////////

    function isValidAccount() {
      let data = incoming();
      return data.keys().hasOnly(['name', 'type', 'balance', 'icon', 'color', 'userId']) &&
             data.keys().hasAll(['name', 'type', 'balance', 'userId']) &&
             isValidString(data.name, 100) &&
             data.type in ['cash', 'bank', 'card', 'investment'] &&
             isValidNumber(data.balance) &&
             data.userId == userId;
    }

    function isValidCategory() {
      let data = incoming();
      return data.keys().hasOnly(['name', 'parent_id', 'type', 'icon', 'color', 'userId']) &&
             data.keys().hasAll(['name', 'type', 'userId']) &&
             isValidString(data.name, 100) &&
             data.type in ['income', 'expense'] &&
             data.userId == userId;
    }

    function isValidTransaction() {
      let data = incoming();
      return data.keys().hasOnly(['type', 'amount', 'date', 'category_id', 'category_name', 'account_id', 'account_name', 'to_account_id', 'to_account_name', 'notes', 'status', 'due_date', 'userId']) &&
             data.keys().hasAll(['type', 'amount', 'date', 'account_id', 'userId']) &&
             data.type in ['income', 'expense', 'transfer', 'due'] &&
             isValidNumber(data.amount) &&
             isValidString(data.date, 30) &&
             data.userId == userId;
    }

    function isValidBudget() {
      let data = incoming();
      return data.keys().hasOnly(['category_id', 'amount', 'period', 'userId']) &&
             data.keys().hasAll(['amount', 'period', 'userId']) &&
             isValidNumber(data.amount) &&
             (data.category_id == null || (data.category_id is string && data.category_id.size() <= 128)) &&
             data.period in ['monthly', 'weekly', 'yearly'] &&
             data.userId == userId;
    }

    function isValidSettings() {
      let data = incoming();
      return data.keys().hasOnly(['currency', 'theme', 'language', 'userId', 'pinHash', 'biometricEnabled', 'dailyReminderEnabled', 'reminderTime', 'budgetAlertsEnabled', 'partnerAlertsEnabled']) &&
             data.keys().hasAll(['userId']) &&
             data.userId == request.auth.uid;
    }

    function isValidUserProfile() {
      let data = incoming();
      return data.keys().hasOnly(['uid', 'email', 'displayName', 'photoURL', 'updatedAt']) &&
             data.keys().hasAll(['uid', 'email', 'displayName', 'updatedAt']) &&
             data.uid == userId &&
             isValidString(data.email, 254) &&
             isValidString(data.displayName, 100) &&
             isValidString(data.updatedAt, 30);
    }

    function isValidPartnerDoc(ownerId, partnerId) {
      let data = incoming();
      return data.keys().hasOnly(['ownerId', 'ownerEmail', 'ownerName', 'ownerPhotoURL', 'partnerId', 'partnerEmail', 'partnerName', 'partnerPhotoURL', 'status', 'permission', 'createdAt', 'acceptedAt']) &&
             data.keys().hasAll(['ownerId', 'partnerId', 'status', 'permission', 'createdAt']) &&
             data.ownerId == ownerId &&
             data.partnerId == partnerId &&
             data.status in ['pending', 'accepted', 'revoked'] &&
             data.permission in ['read', 'write'] &&
             isValidString(data.createdAt, 30);
    }

    function partnerOnlyAcceptsInvite(existingData) {
      let data = incoming();
      return data.status == 'accepted' &&
             existingData.status == 'pending' &&
             data.permission == existingData.permission &&
             data.ownerId == existingData.ownerId &&
             data.partnerId == existingData.partnerId &&
             isValidString(data.acceptedAt, 30);
    }

    function isValidNotification() {
      let data = incoming();
      return data.keys().hasOnly(['userId', 'type', 'title', 'message', 'read', 'createdAt', 'metadata']) &&
             data.keys().hasAll(['userId', 'type', 'title', 'message', 'read', 'createdAt']) &&
             data.userId == userId &&
             data.type in ['partner_invite', 'partner_accept', 'partner_revoke', 'budget_warning', 'budget_exceeded', 'daily_reminder'] &&
             data.read is bool &&
             isValidString(data.createdAt, 30);
    }

    //////////////////// Path Rules ////////////////////

    match /userProfiles/{userId} {
      allow read: if isSignedIn();
      allow create: if isOwner(userId) && isValidUserProfile();
      allow update: if isOwner(userId) && isValidUserProfile();
    }

    match /users/{userId} {
      match /accounts/{accountId} {
        allow read: if isAuthorizedReader(userId);
        allow create: if isAuthorizedWriter(userId) && isValidAccount();
        allow update: if isAuthorizedWriter(userId) && isValidAccount();
        allow delete: if isAuthorizedWriter(userId);
      }
      match /categories/{categoryId} {
        allow read: if isAuthorizedReader(userId);
        allow create: if isAuthorizedWriter(userId) && isValidCategory();
        allow update: if isAuthorizedWriter(userId) && isValidCategory();
        allow delete: if isAuthorizedWriter(userId);
      }
      match /transactions/{transactionId} {
        allow read: if isAuthorizedReader(userId);
        allow create: if isAuthorizedWriter(userId) && isValidTransaction();
        allow update: if isAuthorizedWriter(userId) && isValidTransaction();
        allow delete: if isAuthorizedWriter(userId);
      }
      match /budgets/{budgetId} {
        allow read: if isAuthorizedReader(userId);
        allow create: if isAuthorizedWriter(userId) && isValidBudget();
        allow update: if isAuthorizedWriter(userId) && isValidBudget();
        allow delete: if isAuthorizedWriter(userId);
      }
      match /settings/profile {
        allow read: if isOwner(userId);
        allow create: if isOwner(userId) && isValidSettings();
        allow update: if isOwner(userId) && isValidSettings();
      }
      match /partners/{partnerId} {
        allow read: if isOwner(userId) || request.auth.uid == partnerId;
        allow create: if isOwner(userId) && isValidPartnerDoc(userId, partnerId);
        allow update: if (isOwner(userId) && isValidPartnerDoc(userId, partnerId)) ||
                        (request.auth.uid == partnerId && partnerOnlyAcceptsInvite(existing()));
        allow delete: if isOwner(userId);
      }
      match /sharedWithMe/{ownerId} {
        allow read: if request.auth.uid == userId;
        allow create: if request.auth.uid == ownerId && isValidPartnerDoc(ownerId, userId);
        allow update: if (request.auth.uid == ownerId && isValidPartnerDoc(ownerId, userId)) ||
                        (request.auth.uid == userId && partnerOnlyAcceptsInvite(existing()));
        allow delete: if request.auth.uid == ownerId || request.auth.uid == userId;
      }
      match /notifications/{notificationId} {
        allow read: if isOwner(userId);
        allow create: if isOwner(userId) && isValidNotification();
        allow update: if isOwner(userId) && isValidNotification();
        allow delete: if isOwner(userId);
      }
    }
  }
}