firestore.rules

/**
 * @fileoverview Firestore Security Rules for Saveur Express.
 *
 * Core Philosophy: This ruleset enforces a strict owner-only access model for
 * customer-related data and allows public read access for restaurant data.
 * All writes are protected by authorization checks based on path-based ownership.
 *
 * Data Structure:
 * - Restaurants are stored at the root in `/restaurants/{restaurantId}`.
 * - Restaurant-specific data (dishes, orders, feedback, reservations) resides
 *   in subcollections under each restaurant document.
 * - Customer data is stored under `/customers/{customerId}`.
 *
 * Key Security Decisions:
 * - Listing of customer documents is forbidden.
 * - Restaurant data is publicly readable.
 * - Write access is restricted to owners/authorized users based on the specific
 *   collection.
 *
 * Denormalization for Authorization: No explicit denormalization is used in the
 * initial ruleset, but it is recommended to denormalize roles into documents
 * for collaborative access (e.g., restaurant staff managing tables and orders).
 *
 * Structural Segregation: Public restaurant information resides in the `restaurants`
 * collection, while sensitive customer data is stored in a private subcollection
 * under the `/customers/{customerId}` path. This separation ensures that `list`
 * operations can be securely implemented based on the specific access requirements
 * of each collection.
 */
rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {

    /**
     * @description Allows anyone to read restaurant information, but restricts
     *  writes to authorized users (e.g., restaurant owners or admins - to be defined).
     * @path /restaurants/{restaurantId}
     * @allow get, list: if true;
     * @allow create: if false; // TODO: Add owner validation once the schema is updated with an ownership field.
     * @allow update: if false; // TODO: Add owner validation once the schema is updated with an ownership field.
     * @allow delete: if false; // TODO: Add owner validation once the schema is updated with an ownership field.
     * @principle Allows public read access, requires ownership for writes.
     */
    match /restaurants/{restaurantId} {
      allow get, list: if true;
      allow create: if false; // TODO: Add owner validation once the schema is updated with an ownership field.
      allow update: if false; // TODO: Add owner validation once the schema is updated with an ownership field.
      allow delete: if false; // TODO: Add owner validation once the schema is updated with an ownership field.
    }

    /**
     * @description Allows anyone to read dishes information for a restaurant, but restricts
     *  writes to authorized users (e.g., restaurant owners or admins).
     * @path /restaurants/{restaurantId}/dishes/{dishId}
     * @allow get, list: if true;
     * @allow create: if false; // TODO: Add owner validation once the schema is updated with an ownership field.
     * @allow update: if false; // TODO: Add owner validation once the schema is updated with an ownership field.
     * @allow delete: if false; // TODO: Add owner validation once the schema is updated with an ownership field.
     * @principle Allows public read access, requires ownership for writes.
     */
    match /restaurants/{restaurantId}/dishes/{dishId} {
      allow get, list: if true;
      allow create: if false; // TODO: Add owner validation once the schema is updated with an ownership field.
      allow update: if false; // TODO: Add owner validation once the schema is updated with an ownership field.
      allow delete: if false; // TODO: Add owner validation once the schema is updated with an ownership field.
    }

    /**
     * @description Allows anyone to read table information, but restricts writes
     *  to authorized users (e.g., restaurant owners or admins).
     * @path /tables/{tableId}
     * @allow get, list: if true;
     * @allow create: if false; // TODO: Add owner validation once the schema is updated with an ownership field.
     * @allow update: if false; // TODO: Add owner validation once the schema is updated with an ownership field.
     * @allow delete: if false; // TODO: Add owner validation once the schema is updated with an ownership field.
     * @principle Allows public read access, requires ownership for writes.
     */
    match /tables/{tableId} {
      allow get, list: if true;
      allow create: if false; // TODO: Add owner validation once the schema is updated with an ownership field.
      allow update: if false; // TODO: Add owner validation once the schema is updated with an ownership field.
      allow delete: if false; // TODO: Add owner validation once the schema is updated with an ownership field.
    }

    /**
     * @description Allows anyone to read order information for a restaurant, but restricts
     *  writes to authorized users (e.g., restaurant owners or admins, or the customer who placed the order).
     * @path /restaurants/{restaurantId}/orders/{orderId}
     * @allow get, list: if true;
     * @allow create: if false; // TODO: Add owner validation once the schema is updated with an ownership field.
     * @allow update: if false; // TODO: Add owner validation once the schema is updated with an ownership field.
     * @allow delete: if false; // TODO: Add owner validation once the schema is updated with an ownership field.
     * @principle Allows public read access, requires ownership for writes.
     */
    match /restaurants/{restaurantId}/orders/{orderId} {
      allow get, list: if true;
      allow create: if false; // TODO: Add owner validation once the schema is updated with an ownership field.
      allow update: if false; // TODO: Add owner validation once the schema is updated with an ownership field.
      allow delete: if false; // TODO: Add owner validation once the schema is updated with an ownership field.
    }

    /**
     * @description Allows anyone to read order item information for an order, but restricts
     *  writes to authorized users (e.g., restaurant owners or admins).
     * @path /restaurants/{restaurantId}/orders/{orderId}/orderItems/{orderItemId}
     * @allow get, list: if true;
     * @allow create: if false; // TODO: Add owner validation once the schema is updated with an ownership field.
     * @allow update: if false; // TODO: Add owner validation once the schema is updated with an ownership field.
     * @allow delete: if false; // TODO: Add owner validation once the schema is updated with an ownership field.
     * @principle Allows public read access, requires ownership for writes.
     */
    match /restaurants/{restaurantId}/orders/{orderId}/orderItems/{orderItemId} {
      allow get, list: if true;
      allow create: if false; // TODO: Add owner validation once the schema is updated with an ownership field.
      allow update: if false; // TODO: Add owner validation once the schema is updated with an ownership field.
      allow delete: if false; // TODO: Add owner validation once the schema is updated with an ownership field.
    }

    /**
     * @description Restricts access to customer information to the customer themselves.
     * @path /customers/{customerId}
     * @allow get: if isOwner(customerId);
     * @allow list: if false;
     * @allow create: if request.auth.uid == customerId;
     * @allow update: if isOwner(customerId);
     * @allow delete: if isOwner(customerId);
     * @principle Enforces document ownership for writes.
     */
    match /customers/{customerId} {
      allow get: if isOwner(customerId);
      allow list: if false;
      allow create: if request.auth.uid == customerId;
      allow update: if isOwner(customerId);
      allow delete: if isOwner(customerId);
    }

    /**
     * @description Allows anyone to read feedback information for a restaurant, but restricts
     *  writes to authorized users (e.g., restaurant owners or admins, or the customer who provided the feedback).
     * @path /restaurants/{restaurantId}/feedback/{feedbackId}
     * @allow get, list: if true;
     * @allow create: if false; // TODO: Add owner validation once the schema is updated with an ownership field.
     * @allow update: if false; // TODO: Add owner validation once the schema is updated with an ownership field.
     * @allow delete: if false; // TODO: Add owner validation once the schema is updated with an ownership field.
     * @principle Allows public read access, requires ownership for writes.
     */
    match /restaurants/{restaurantId}/feedback/{feedbackId} {
      allow get, list: if true;
      allow create: if false; // TODO: Add owner validation once the schema is updated with an ownership field.
      allow update: if false; // TODO: Add owner validation once the schema is updated with an ownership field.
      allow delete: if false; // TODO: Add owner validation once the schema is updated with an ownership field.
    }

    /**
     * @description Restricts access to loyalty points information to the customer themselves.
     * @path /customers/{customerId}/loyaltyPoints/{loyaltyPointsId}
     * @allow get: if isOwner(customerId);
     * @allow list: if isOwner(customerId);
     * @allow create: if request.auth.uid == customerId;
     * @allow update: if isOwner(customerId);
     * @allow delete: if isOwner(customerId);
     * @principle Enforces document ownership for writes.
     */
    match /customers/{customerId}/loyaltyPoints/{loyaltyPointsId} {
      allow get: if isOwner(customerId);
      allow list: if isOwner(customerId);
      allow create: if request.auth.uid == customerId;
      allow update: if isOwner(customerId);
      allow delete: if isOwner(customerId);
    }

    /**
     * @description Allows anyone to read reservation information for a restaurant, but restricts
     *  writes to authorized users (e.g., restaurant owners or admins, or the customer who made the reservation).
     * @path /restaurants/{restaurantId}/reservations/{reservationId}
     * @allow get, list: if true;
     * @allow create: if false; // TODO: Add owner validation once the schema is updated with an ownership field.
     * @allow update: if false; // TODO: Add owner validation once the schema is updated with an ownership field.
     * @allow delete: if false; // TODO: Add owner validation once the schema is updated with an ownership field.
     * @principle Allows public read access, requires ownership for writes.
     */
    match /restaurants/{restaurantId}/reservations/{reservationId} {
      allow get, list: if true;
      allow create: if false; // TODO: Add owner validation once the schema is updated with an ownership field.
      allow update: if false; // TODO: Add owner validation once the schema is updated with an ownership field.
      allow delete: if false; // TODO: Add owner validation once the schema is updated with an ownership field.
    }

    /**
     * @description Checks if the requesting user is the owner of the document.
     * @param {string} userId The user ID to check against the request's authentication UID.
     * @return {bool} True if the user ID matches the request's authentication UID, false otherwise.
     */
    function isOwner(userId) {
      return request.auth.uid == userId;
    }
  }
}