firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    // Deny read/write by default
    match /{document=**} {
      allow read, write: if false;
    }
    
    // Enforce owner check for notes
    match /users/{uid}/notes/{noteId} {
      allow read, update, delete: if request.auth != null 
                                  && request.auth.uid == uid 
                                  && resource.data.ownerId == uid;
                                  
      allow create: if request.auth != null 
                    && request.auth.uid == uid 
                    && request.resource.data.ownerId == uid;
    }

    // Public notes collection - client writes are blocked (Worker Admin only)
    match /public_notes/{noteId} {
      allow read: if true;
      allow write, delete: if false;
    }
  }
}