Infrastructure Security

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    
    // Helper to check if user is a system admin/owner
    function isSystemAdmin() {
      return get(/databases/$(database)/documents/users/$(request.auth.uid)).data.role in ['owner', 'admin'];
    }

    // User profiles: Users can read/write their own, admins can do everything
    match /users/{userId} {
      allow read: if request.auth != null;
      allow write: if request.auth.uid == userId || isSystemAdmin();
    }

    // Applications: Only owners can create/edit, admins can read
    match /apps/{appId} {
      allow read: if request.auth != null;
      allow create, update, delete: if isSystemAdmin() || resource.data.ownerUid == request.auth.uid;
    }

    // Licenses: Strictly protected
    match /licenses/{licenseId} {
      allow read: if request.auth != null;
      allow write: if isSystemAdmin();
    }
  }
}