firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    // Allow users to read/write their own profiles
    match /users/{userId} {
      allow get: if request.auth != null && (request.auth.uid == userId || get(/databases/$(database)/documents/users/$(request.auth.uid)).data.role == 'admin');
      allow create, update: if request.auth != null && request.auth.uid == userId;
      allow list: if request.auth != null && get(/databases/$(database)/documents/users/$(request.auth.uid)).data.role == 'admin';
    }

    // Only allow users to read/write their own designs
    match /designs/{designId} {
      allow read, write: if request.auth != null && request.auth.uid == resource.data.userId;
      // Also allow creation if their user ID matches the new document
      allow create: if request.auth != null && request.auth.uid == request.resource.data.userId;
    }
  }
}