firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {

    // ==================== Users ====================
    match /users/{userId} {
      allow read: if request.auth != null
        && (request.auth.uid == userId || isPartnerOf(userId));

      allow create: if request.auth != null
        && request.auth.uid == userId
        && request.resource.data.keys().hasAll(['email', 'displayName', 'createdAt'])
        && request.resource.data.keys().hasOnly(['email', 'displayName', 'createdAt', 'avatarUrl', 'coupleId', 'timezone', 'updatedAt'])
        && request.resource.data.email is string
        && request.resource.data.displayName is string
        && request.resource.data.displayName.size() >= 1
        && request.resource.data.displayName.size() <= 100;

      allow update: if request.auth != null
        && request.auth.uid == userId
        && !request.resource.data.diff(resource.data).affectedKeys().hasAny(['email', 'createdAt']);

      allow delete: if false;
    }

    // ==================== Couples ====================
    match /couples/{coupleId} {
      allow read: if request.auth != null && isCoupleMember(coupleId);

      allow create: if request.auth != null
        && request.resource.data.user1Id == request.auth.uid
        && request.resource.data.inviteCode is string
        && request.resource.data.inviteCode.size() == 12
        && request.resource.data.keys().hasOnly(['user1Id', 'user2Id', 'inviteCode', 'coupleSalt', 'keyVerifier', 'kdfVersion', 'status', 'createdAt']);

      // `status` and `inviteCode` are the only fields a member may change
      // after creation. All other structural fields are immutable — a
      // member cannot flip user2Id or rotate keys to hijack the couple.
      allow update: if request.auth != null
        && isCoupleMember(coupleId)
        && !request.resource.data.diff(resource.data).affectedKeys().hasAny([
          'user1Id', 'user2Id', 'coupleSalt', 'keyVerifier', 'kdfVersion', 'createdAt'
        ]);

      allow delete: if false;

      // ==================== Categories (subcollection) ====================
      match /categories/{categoryId} {
        allow read: if request.auth != null && isCoupleMember(coupleId);

        allow create: if request.auth != null
          && isCoupleMember(coupleId)
          && request.resource.data.name is string
          && request.resource.data.name.size() >= 1
          && request.resource.data.name.size() <= 50
          && request.resource.data.keys().hasOnly(['name', 'icon', 'color', 'coupleId', 'sortOrder', 'isDefault', 'createdAt']);

        allow update: if request.auth != null
          && isCoupleMember(coupleId)
          && request.resource.data.name is string
          && request.resource.data.name.size() >= 1
          && request.resource.data.name.size() <= 50;
        allow delete: if request.auth != null && isCoupleMember(coupleId);

        match /subcategories/{subId} {
          allow read: if request.auth != null && isCoupleMember(coupleId);

          allow create: if request.auth != null
            && isCoupleMember(coupleId)
            && request.resource.data.name is string
            && request.resource.data.name.size() >= 1
            && request.resource.data.name.size() <= 50
            && request.resource.data.keys().hasOnly(['categoryId', 'name', 'icon', 'sortOrder', 'createdAt']);

          allow update: if request.auth != null
            && isCoupleMember(coupleId)
            && request.resource.data.name is string
            && request.resource.data.name.size() >= 1
            && request.resource.data.name.size() <= 50;

          allow delete: if request.auth != null && isCoupleMember(coupleId);
        }
      }

      // ==================== Tasks (subcollection) ====================
      // Size limits MUST match src/validation/schemas.ts (taskSchema).
      match /tasks/{taskId} {
        allow read: if request.auth != null && isCoupleMember(coupleId);

        allow create: if request.auth != null
          && isCoupleMember(coupleId)
          && request.resource.data.title is string
          && request.resource.data.title.size() >= 1
          && request.resource.data.title.size() <= 200
          && request.resource.data.coupleId == coupleId
          && (!('description' in request.resource.data)
              || (request.resource.data.description is string
                  && request.resource.data.description.size() <= 2000));

        allow update: if request.auth != null
          && isCoupleMember(coupleId)
          && !request.resource.data.diff(resource.data).affectedKeys().hasAny(['coupleId', 'createdBy', 'createdAt'])
          && (!('description' in request.resource.data)
              || (request.resource.data.description is string
                  && request.resource.data.description.size() <= 2000));

        allow delete: if request.auth != null && isCoupleMember(coupleId);

        // ==================== Task Comments (nested subcollection) ====================
        match /comments/{commentId} {
          allow read: if request.auth != null && isCoupleMember(coupleId);

          allow create: if request.auth != null
            && isCoupleMember(coupleId)
            && request.resource.data.userId == request.auth.uid
            && request.resource.data.text is string
            && request.resource.data.text.size() >= 1
            && request.resource.data.text.size() <= 2000
            && request.resource.data.keys().hasOnly(['userId', 'userName', 'text', 'createdAt']);

          allow update: if request.auth != null
            && isCoupleMember(coupleId)
            && resource.data.userId == request.auth.uid;

          allow delete: if request.auth != null
            && isCoupleMember(coupleId)
            && resource.data.userId == request.auth.uid;
        }
      }

      // ==================== Events (subcollection) ====================
      // Size limits MUST match src/validation/schemas.ts (eventSchema).
      match /events/{eventId} {
        allow read: if request.auth != null && isCoupleMember(coupleId);

        allow create: if request.auth != null
          && isCoupleMember(coupleId)
          && request.resource.data.title is string
          && request.resource.data.title.size() >= 1
          && request.resource.data.title.size() <= 200
          && (!('description' in request.resource.data)
              || (request.resource.data.description is string
                  && request.resource.data.description.size() <= 2000));

        allow update: if request.auth != null
          && isCoupleMember(coupleId)
          && !request.resource.data.diff(resource.data).affectedKeys().hasAny(['coupleId', 'createdBy', 'createdAt'])
          && (!('description' in request.resource.data)
              || (request.resource.data.description is string
                  && request.resource.data.description.size() <= 2000));

        allow delete: if request.auth != null && isCoupleMember(coupleId);
      }

      // ==================== Shopping Items (subcollection) ====================
      // Size limits MUST match src/validation/schemas.ts (shoppingItemSchema).
      match /shoppingItems/{itemId} {
        allow read: if request.auth != null && isCoupleMember(coupleId);

        allow create: if request.auth != null
          && isCoupleMember(coupleId)
          && request.resource.data.name is string
          && request.resource.data.name.size() >= 1
          && request.resource.data.name.size() <= 200;

        allow update: if request.auth != null
          && isCoupleMember(coupleId)
          && request.resource.data.name is string
          && request.resource.data.name.size() >= 1
          && request.resource.data.name.size() <= 200;
        allow delete: if request.auth != null && isCoupleMember(coupleId);
      }

      // ==================== Notes (subcollection) ====================
      // Size limits MUST match src/validation/schemas.ts (noteSchema).
      match /notes/{noteId} {
        allow read: if request.auth != null && isCoupleMember(coupleId);

        allow create: if request.auth != null
          && isCoupleMember(coupleId)
          && request.resource.data.title is string
          && request.resource.data.title.size() >= 1
          && request.resource.data.title.size() <= 200
          && (!('content' in request.resource.data)
              || (request.resource.data.content is string
                  && request.resource.data.content.size() <= 10000));

        allow update: if request.auth != null
          && isCoupleMember(coupleId)
          && !request.resource.data.diff(resource.data).affectedKeys().hasAny(['coupleId', 'createdBy', 'createdAt'])
          && (!('content' in request.resource.data)
              || (request.resource.data.content is string
                  && request.resource.data.content.size() <= 10000));

        allow delete: if request.auth != null && isCoupleMember(coupleId);
      }

      // ==================== Inventory Items (subcollection) ====================
      // Size limits MUST match src/validation/inventorySchemas.ts (inventoryItemSchema).
      match /inventoryItems/{itemId} {
        allow read: if request.auth != null && isCoupleMember(coupleId);

        allow create: if request.auth != null
          && isCoupleMember(coupleId)
          && request.resource.data.name is string
          && request.resource.data.name.size() >= 1 && request.resource.data.name.size() <= 200;

        allow update: if request.auth != null
          && isCoupleMember(coupleId)
          && !request.resource.data.diff(resource.data).affectedKeys().hasAny(['coupleId', 'createdBy', 'createdAt'])
          && request.resource.data.name is string
          && request.resource.data.name.size() >= 1
          && request.resource.data.name.size() <= 200;

        allow delete: if request.auth != null && isCoupleMember(coupleId);
      }

      // ==================== Retrospectives (subcollection) ====================
      match /retrospectives/{monthKey} {
        allow read: if request.auth != null && isCoupleMember(coupleId);

        allow create: if request.auth != null
          && isCoupleMember(coupleId)
          && request.resource.data.coupleId == coupleId
          && request.resource.data.keys().hasOnly([
            'id', 'coupleId', 'monthKey', 'generatedAt', 'generatedBy',
            'summary', 'categoryBreakdown', 'gamification',
            'aiInsights', 'aiActionItems',
            'highlights', 'improvements', 'gratitude', 'fairnessScore',
            'createdBy', 'createdAt', 'updatedAt', 'responses'
          ]);

        allow update: if request.auth != null
          && isCoupleMember(coupleId)
          && !request.resource.data.diff(resource.data).affectedKeys().hasAny(['coupleId', 'generatedBy', 'createdBy', 'createdAt']);

        allow delete: if false;
      }

      // ==================== Streaks (subcollection) ====================
      match /streaks/{userId} {
        allow read: if request.auth != null && isCoupleMember(coupleId);

        allow write: if request.auth != null
          && isCoupleMember(coupleId)
          && request.auth.uid == userId
          && request.resource.data.keys().hasOnly(['currentStreak', 'longestStreak', 'totalCompletions', 'lastCompletionDate', 'lastCompletedAt', 'updatedAt'])
          && request.resource.data.currentStreak is int
          && request.resource.data.currentStreak >= 0
          && request.resource.data.currentStreak <= 3650
          && request.resource.data.longestStreak is int
          && request.resource.data.longestStreak >= 0
          && request.resource.data.longestStreak <= 3650
          && request.resource.data.totalCompletions is int
          && request.resource.data.totalCompletions >= 0
          && (resource == null || request.resource.data.totalCompletions >= resource.data.totalCompletions);
      }

      // ==================== Badges (subcollection) ====================
      match /badges/{userId} {
        allow read: if request.auth != null && isCoupleMember(coupleId);

        allow write: if request.auth != null
          && isCoupleMember(coupleId)
          && request.auth.uid == userId
          && request.resource.data.keys().hasOnly(['unlocked', 'stats', 'updatedAt'])
          && request.resource.data.unlocked is map
          && request.resource.data.stats is map;
      }

      // ==================== Meta (subcollection) ====================
      // XP and level are written only by the `awardXp` Cloud Function,
      // which runs with admin privileges and bypasses these rules. Clients
      // have read-only access so the UI can render progress.
      match /meta/{docId} {
        allow read: if request.auth != null && isCoupleMember(coupleId);
        allow write: if false;
      }
    }

    // ==================== FCM Tokens (server-only read) ====================
    match /fcmTokens/{userId} {
      allow write: if request.auth != null && request.auth.uid == userId;
      allow read: if false;
    }

    // ==================== Invite Code Lookup (rate-limited reads + 7-day expiry) ====================
    match /inviteCodes/{code} {
      allow read: if request.auth != null
        && resource != null
        && resource.data.createdAt is timestamp
        && request.time < resource.data.createdAt + duration.value(7, 'd')
        && isNotRateLimited('inviteCodeRead');
      allow create: if request.auth != null
        && request.resource.data.coupleId is string
        && request.resource.data.createdBy == request.auth.uid
        && request.resource.data.createdAt is timestamp
        && request.resource.data.keys().hasOnly(['coupleId', 'createdBy', 'createdAt', 'expiresAt'])
        && isNotRateLimited('inviteCode');
      allow update, delete: if false;
    }

    // ==================== Nudges (rate-limited) ====================
    // Sender-side: 1 per 30s per user, enforced via rateLimits bucket.
    // Recipient-side: a Cloud Function caps nudges at 10/day/recipient and
    // respects their quiet hours; we cannot query other users here without
    // an unbounded get() cost, so the server does the per-recipient cap.
    match /nudges/{nudgeId} {
      allow create: if request.auth != null
        && request.resource.data.fromUserId == request.auth.uid
        && request.resource.data.fromUserId != request.resource.data.toUserId
        && request.resource.data.keys().hasAll(['coupleId', 'fromUserId', 'toUserId', 'taskId', 'taskTitle', 'status'])
        && request.resource.data.keys().hasOnly(['coupleId', 'fromUserId', 'toUserId', 'taskId', 'taskTitle', 'status', 'createdAt'])
        && request.resource.data.taskTitle is string
        && request.resource.data.taskTitle.size() >= 1
        && request.resource.data.taskTitle.size() <= 200
        && isCoupleMember(request.resource.data.coupleId)
        && isNotRateLimited('nudge');
      allow read: if request.auth != null
        && (resource.data.fromUserId == request.auth.uid
        || resource.data.toUserId == request.auth.uid);
      allow update, delete: if false;
    }

    // ==================== Rate Limit Buckets (written by client, validated server-side) ====================
    // Each user has one document per action type: rateLimits/{userId}/buckets/{action}
    // The document stores { lastWrite: timestamp } and enforces minimum intervals.
    match /rateLimits/{userId}/buckets/{action} {
      allow read: if request.auth != null && request.auth.uid == userId;
      allow write: if request.auth != null
        && request.auth.uid == userId
        && request.resource.data.keys().hasOnly(['lastWrite'])
        && request.resource.data.lastWrite == request.time;
    }

    // ==================== Helper Functions ====================
    function isCoupleMember(coupleId) {
      let couple = get(/databases/$(database)/documents/couples/$(coupleId));
      return couple.data.user1Id == request.auth.uid
        || couple.data.user2Id == request.auth.uid;
    }

    function isPartnerOf(userId) {
      let user = get(/databases/$(database)/documents/users/$(request.auth.uid));
      return user.data.coupleId != null
        && isCoupleMember(user.data.coupleId)
        && get(/databases/$(database)/documents/users/$(userId)).data.coupleId == user.data.coupleId;
    }

    // Rate-limit helper: checks that the last write for an action is older than the minimum interval.
    // Actions: 'nudge' (30s), 'inviteCode' (60s)
    function isNotRateLimited(action) {
      let intervals = { 'nudge': duration.value(30, 's'), 'inviteCode': duration.value(60, 's'), 'inviteCodeRead': duration.value(5, 's') };
      let bucket = get(/databases/$(database)/documents/rateLimits/$(request.auth.uid)/buckets/$(action));
      return bucket == null
        || !bucket.data.keys().hasAny(['lastWrite'])
        || request.time > bucket.data.lastWrite + intervals[action];
    }

    // ==================== Deny everything else ====================
    match /{document=**} {
      allow read, write: if false;
    }
  }
}