firebase.firestore.rules

rules_version = '2';

service cloud.firestore {
  match /databases/{database}/documents {
    match /users/{userId} {
      // No client side reads for core users data
      allow read, write: if false;

      // Allow authenticated users to read their profile
      match /profile/{userId} {
        allow read: if request.auth.uid == userId;
        allow write: if false;
      }
    }

    match /prefectures/{prefectureId} {
      // No client side reads for core prefectures data
      allow read, write: if false;

      // Allow authenticated users to read prefectures message
      match /denormalizedForAppAccess/{prefectureId} {
        allow read: if request.auth.uid != null;
        allow write: if false;
      }
    }
  }
}