firestore.rules

rules_version = '2';

service cloud.firestore {
  match /databases/{database}/documents {

    // ===============================================================
    // Data Model
    // ===============================================================
    //
    // users/{userId}/transactions/{txId}
    //   type: string, "income" | "expense"
    //   amount: number, > 0
    //   category: string, 1..40 chars
    //   note: string, <= 500 chars
    //   date: string, YYYY-MM-DD
    //   createdAt: number, epoch ms
    //   createdByUid / createdByName / createdByPhotoURL
    //
    // books/{bookId}
    //   name: string, 1..80 chars
    //   ownerUid: string, immutable owner uid
    //   ownerName: string, 1..100 chars
    //   memberIds: list<string>, max 50 (always == keys of `members`)
    //   members: map<uid, BookMember>, max 50
    //   createdAt: number, epoch ms (immutable)
    //   updatedAt: number, epoch ms
    //   deleted: bool, optional (soft delete by the owner)
    //
    //   Only MEMBERS can read a book. There is no join password: a person who
    //   knows the book id sends a join request and the OWNER approves it.
    //
    // books/{bookId}/transactions/{txId}
    //   same fields as a personal transaction; members read, owner/editor write.
    //
    // books/{bookId}/joinRequests/{requesterUid}
    //   requesterUid, requesterName, requesterPhotoURL, requestedAt,
    //   role ("viewer"), status ("pending" | "rejected")
    //   Approving = the owner adds the member to the book and deletes the request.
    //
    // ===============================================================

    function isAuthenticated() {
      return request.auth != null;
    }

    function isOwner(userId) {
      return isAuthenticated() && request.auth.uid == userId;
    }

    function validString(data, field, minLen, maxLen) {
      return data[field] is string &&
        data[field].size() >= minLen &&
        data[field].size() <= maxLen;
    }

    function validOptionalUrl(data, field) {
      return data[field] is string &&
        data[field].size() <= 500 &&
        (data[field] == "" || data[field].matches("^https?://.*"));
    }

    function validEpochMs(data, field) {
      return data[field] is number &&
        data[field] > 0 &&
        data[field] < 4102444800000;
    }

    function isValidTransaction(data) {
      return data.keys().hasOnly([
        "type", "amount", "category", "note", "date", "createdAt",
        "createdByUid", "createdByName", "createdByPhotoURL"
      ]) &&
      data.keys().hasAll([
        "type", "amount", "category", "note", "date", "createdAt",
        "createdByUid", "createdByName", "createdByPhotoURL"
      ]) &&
      data.type in ["income", "expense"] &&
      data.amount is number &&
      data.amount > 0 &&
      data.amount < 1000000000 &&
      validString(data, "category", 1, 40) &&
      validString(data, "note", 0, 500) &&
      data.date is string &&
      data.date.matches("^\\d{4}-(0[1-9]|1[0-2])-(0[1-9]|[12]\\d|3[01])$") &&
      validEpochMs(data, "createdAt") &&
      data.createdByUid == request.auth.uid &&
      validString(data, "createdByName", 1, 100) &&
      validOptionalUrl(data, "createdByPhotoURL");
    }

    function txImmutableFieldsUnchanged() {
      return request.resource.data.createdAt == resource.data.createdAt &&
        request.resource.data.createdByUid == resource.data.createdByUid;
    }

    // Account deletion: any member — whatever their current role — may strip their own
    // identity from the entries they wrote. Nothing else about the entry may change.
    function isOwnTxAnonymization(bookId) {
      return isBookMemberById(bookId) &&
        resource.data.createdByUid == request.auth.uid &&
        request.resource.data.diff(resource.data).affectedKeys().hasOnly(["createdByName", "createdByPhotoURL"]) &&
        request.resource.data.createdByName == "ผู้ใช้ที่ลบบัญชี" &&
        request.resource.data.createdByPhotoURL == "";
    }

    function isValidMember(member, role) {
      return member is map &&
        member.keys().hasOnly(["name", "photoURL", "role", "joinedAt"]) &&
        member.keys().hasAll(["name", "photoURL", "role", "joinedAt"]) &&
        member.name is string &&
        member.name.size() >= 1 &&
        member.name.size() <= 100 &&
        member.photoURL is string &&
        member.photoURL.size() <= 500 &&
        (member.photoURL == "" || member.photoURL.matches("^https?://.*")) &&
        member.role in ["owner", "editor", "viewer"] &&
        member.role == role &&
        member.joinedAt is number &&
        member.joinedAt > 0 &&
        member.joinedAt < 4102444800000;
    }

    function bookPath(bookId) {
      return /databases/$(database)/documents/books/$(bookId);
    }

    function bookData(bookId) {
      return get(bookPath(bookId)).data;
    }

    function isBookOwner(bookId) {
      return isAuthenticated() &&
        exists(bookPath(bookId)) &&
        bookData(bookId).ownerUid == request.auth.uid;
    }

    function isBookMemberById(bookId) {
      return isAuthenticated() &&
        exists(bookPath(bookId)) &&
        request.auth.uid in bookData(bookId).memberIds;
    }

    function canWriteBook(bookId) {
      return isBookMemberById(bookId) &&
        bookData(bookId).get("deleted", false) == false &&
        bookData(bookId).members[request.auth.uid].role in ["owner", "editor"];
    }

    function isValidCreatedBook(data) {
      return data.keys().hasOnly([
        "name", "ownerUid", "ownerName", "memberIds", "members",
        "createdAt", "updatedAt"
      ]) &&
      data.keys().hasAll([
        "name", "ownerUid", "ownerName", "memberIds", "members",
        "createdAt", "updatedAt"
      ]) &&
      validString(data, "name", 1, 80) &&
      data.ownerUid == request.auth.uid &&
      validString(data, "ownerName", 1, 100) &&
      data.memberIds is list &&
      data.memberIds.size() == 1 &&
      data.memberIds[0] == request.auth.uid &&
      data.members is map &&
      data.members.keys().hasOnly([request.auth.uid]) &&
      isValidMember(data.members[request.auth.uid], "owner") &&
      validEpochMs(data, "createdAt") &&
      validEpochMs(data, "updatedAt");
    }

    // The owner may rename the book, soft-delete it and manage members.
    // `joinPassword` (legacy field from the old password flow) may only be
    // REMOVED, never written — it is not in the allowed key list.
    function isValidOwnerUpdate() {
      return isAuthenticated() &&
        resource.data.ownerUid == request.auth.uid &&
        request.resource.data.keys().hasOnly([
          "name", "ownerUid", "ownerName", "memberIds", "members",
          "createdAt", "updatedAt", "deleted"
        ]) &&
        request.resource.data.ownerUid == resource.data.ownerUid &&
        request.resource.data.createdAt == resource.data.createdAt &&
        validString(request.resource.data, "name", 1, 80) &&
        validString(request.resource.data, "ownerName", 1, 100) &&
        request.resource.data.memberIds is list &&
        request.resource.data.memberIds.size() <= 50 &&
        request.resource.data.members is map &&
        request.resource.data.members.size() <= 50 &&
        request.resource.data.memberIds.toSet() == request.resource.data.members.keys().toSet() &&
        request.auth.uid in request.resource.data.memberIds &&
        request.resource.data.members[request.auth.uid].role == "owner";
    }

    // A non-owner member may remove ONLY themself from the book.
    function isValidMemberLeave() {
      return isAuthenticated() &&
        request.auth.uid in resource.data.memberIds &&
        resource.data.ownerUid != request.auth.uid &&
        request.resource.data.diff(resource.data).affectedKeys().hasOnly([
          "memberIds", "members", "updatedAt"
        ]) &&
        !(request.auth.uid in request.resource.data.memberIds) &&
        request.resource.data.memberIds.size() == resource.data.memberIds.size() - 1 &&
        request.resource.data.members.diff(resource.data.members).affectedKeys().hasOnly([request.auth.uid]) &&
        validEpochMs(request.resource.data, "updatedAt");
    }

    match /users/{userId}/transactions/{txId} {
      allow read: if isOwner(userId);
      allow create: if isOwner(userId) && isValidTransaction(request.resource.data);
      allow update: if isOwner(userId) && isValidTransaction(request.resource.data) && txImmutableFieldsUnchanged();
      allow delete: if isOwner(userId);
    }

    // "Which books did I ask to join?" — kept server-side so it works on every device and
    // so account deletion can withdraw every pending request. Private to the user.
    match /users/{userId}/joinRequestRefs/{bookId} {
      allow read, delete: if isOwner(userId);
      allow create, update: if isOwner(userId) &&
        request.resource.data.keys().hasOnly(["requestedAt"]) &&
        validEpochMs(request.resource.data, "requestedAt");
    }

    match /books/{bookId} {
      allow create: if isAuthenticated() && isValidCreatedBook(request.resource.data);

      // get + list: members only. Clients must query with
      // where("memberIds", "array-contains", uid).
      allow read: if isAuthenticated() && request.auth.uid in resource.data.memberIds;

      allow update: if isValidOwnerUpdate() || isValidMemberLeave();

      // Only the owner may hard-delete a book. Used by "delete my account", which
      // first purges the book's transactions and join requests.
      allow delete: if isAuthenticated() && resource.data.ownerUid == request.auth.uid;

      match /transactions/{txId} {
        allow read: if isBookMemberById(bookId);
        allow create: if canWriteBook(bookId) && isValidTransaction(request.resource.data);
        allow update: if (canWriteBook(bookId) && isValidTransaction(request.resource.data) && txImmutableFieldsUnchanged()) ||
          isOwnTxAnonymization(bookId);
        // The owner can always purge (even a soft-deleted book) — needed for account deletion.
        allow delete: if canWriteBook(bookId) || isBookOwner(bookId);
      }

      // Doc id == requester uid, so each person has at most one request per book.
      match /joinRequests/{requesterUid} {
        function isValidJoinRequest(data) {
          return data.keys().hasOnly([
            "requesterUid", "requesterName", "requesterPhotoURL", "requestedAt", "role", "status"
          ]) &&
          data.keys().hasAll([
            "requesterUid", "requesterName", "requesterPhotoURL", "requestedAt", "role", "status"
          ]) &&
          data.requesterUid == request.auth.uid &&
          validString(data, "requesterName", 1, 100) &&
          validOptionalUrl(data, "requesterPhotoURL") &&
          validEpochMs(data, "requestedAt") &&
          data.role == "viewer" &&
          data.status == "pending";
        }

        // Path-based on purpose: lets a requester read their own request
        // before it exists (needed for onSnapshot on a not-yet-created doc).
        allow read: if isAuthenticated() &&
          (request.auth.uid == requesterUid || isBookOwner(bookId));

        allow create: if isAuthenticated() &&
          request.auth.uid == requesterUid &&
          exists(bookPath(bookId)) &&
          !(request.auth.uid in bookData(bookId).memberIds) &&
          isValidJoinRequest(request.resource.data);

        // Owner can only flip the status to "rejected".
        allow update: if isBookOwner(bookId) &&
          request.resource.data.diff(resource.data).affectedKeys().hasOnly(["status"]) &&
          request.resource.data.status == "rejected";

        // Requester withdraws / dismisses; owner clears after approve/reject.
        allow delete: if isAuthenticated() &&
          (request.auth.uid == requesterUid || isBookOwner(bookId));
      }
    }
  }
}