rules_version = '2'

// Security rules for the mnswpr leaderboard. Firestore is schemaless, so these
// rules are the enforced schema: public reads for the boards, validated
// create-only writes for scores, no client writes to server config.
//
// The Firebase web config that ships in the client is public by design (it is
// not a secret); these rules — not secrecy — are what govern access. No
// collection allows a client to update or delete existing docs. Keep any
// admin/service-account credentials out of the repo and locked down in GCP.
//
// Rules match by namespace SUFFIX (regex) rather than a literal prefix, so the
// same set covers production (`mw-*`) and test (`mw-test-*`) collections in the
// one project — and any future namespace. Firestore ORs all matching rules, and
// `{ns}-scores`, `{ns}-all` and `{ns}-leaders` share a 4-segment shape, so each
// block is guarded by a regex on the captured collection name.
//
// Deploy with (see docs/firebase-leaderboards.md):
//   pnpm -F mnswpr exec firebase deploy --only firestore:rules --project prod
service cloud.firestore {
  match /databases/{database}/documents {

    // Ranked, time-windowed scores — public read, validated create-only.
    match /{scores}/{category}/games/{game} {
      allow read:   if scores.matches('mw(-[a-z]+)?-scores');
      allow create: if scores.matches('mw(-[a-z]+)?-scores') && isValidScore(category);
      allow update, delete: if false;
    }

    // Legacy all-time collection, frozen into the static Legends page — read-only.
    match /{leaders}/{category}/games/{game} {
      allow read:  if leaders.matches('mw(-[a-z]+)?-leaders');
      allow write: if false;
    }

    // Per-browser personal archive. Not readable by clients, append/merge only,
    // and never deletable. The doc is a map of gameId -> game object (one doc
    // per day, merged as games finish); the entry-count cap keeps a single doc
    // bounded (Firestore already limits any doc to 1 MiB). 500 is far above any
    // real day of play.
    match /{all}/{browserId}/games/{session} {
      allow read:           if false;
      allow create, update: if all.matches('mw(-[a-z]+)?-all')
                            && request.resource.data.size() <= 500;
      allow delete:         if false;
    }

    // Server config (passingStatus, message) — public read, no client write.
    match /{config}/{document} {
      allow read:  if config.matches('mw(-[a-z]+)?-config');
      allow write: if false;
    }

    // Defense-in-depth: deny anything not matched above. Firestore already
    // default-denies unmatched paths; this makes the intent explicit and is a
    // backstop if a future rule is added carelessly. (Allows are OR-ed, so this
    // never revokes the specific grants above.)
    match /{document=**} {
      allow read, write: if false;
    }

    // A well-formed score: numeric score, bounded name, string bucket keys, and
    // a category matching the path. Rules have no clock, so they can't verify
    // the buckets are correctly derived from time_stamp — that stays the client's
    // job. Extra fields (playerId, time_stamp, meta) are allowed.
    function isValidScore(category) {
      let d = request.resource.data;
      return d.score is number
        && d.score >= 0
        && d.category == category
        && d.name is string
        && d.name.size() <= 24
        && d.day is string
        && d.week is string
        && d.month is string;
    }
  }
}