rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    // Allow authenticated users to read/write their own data
    match /users/{userId} {
      allow read, write: if request.auth != null && request.auth.uid == userId;
    }

    // Allow authenticated users to read/write their own prayers
    match /prayers/{prayerId} {
      allow read, write: if request.auth != null && 
        resource.data.userId == request.auth.uid;
      allow create: if request.auth != null && 
        request.resource.data.userId == request.auth.uid;
    }

    // Allow server-side API access for scheduled emails (no auth required for GET)
    match /prayers {
      allow read: if true;
    }

    // Allow server-side API access for scheduled emails
    match /users {
      allow read: if true;
    }

    // Allow authenticated users to read/write config (for admin settings)
    match /config/{configId} {
      allow read, write: if request.auth != null;
    }

    // Allow anyone to read public data (if needed in future)
    match /public/{document} {
      allow read: if true;
    }
  }
}