firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {

    function isSignedIn() {
      return request.auth != null;
    }

    function isOwner(userId) {
      return isSignedIn() && request.auth.uid == userId;
    }

    match /users/{userId} {
      allow read, write: if isOwner(userId);
    }

    match /forms/{formId} {
      // Any authenticated user can create a form, ensuring they set themselves as owner.
      allow create: if isSignedIn() && request.resource.data.ownerId == request.auth.uid;
      
      // Only the owner of the form can read, update, or delete their form.
      allow read, update, delete: if isOwner(resource.data.ownerId);

      // Allow a user to list the forms they own.
      allow list: if isSignedIn() && request.query.where.ownerId == request.auth.uid;

      // Allow public read for forms that are explicitly published.
      allow get: if resource.data.isPublished == true;
    }

    match /responses/{responseId} {
      // Anyone can submit a response to a form that is published.
      allow create: if get(/databases/$(database)/documents/forms/$(request.resource.data.formId)).data.isPublished == true;

      // Only the owner of the form can read the responses.
      allow read, list, delete: if isSignedIn() && get(/databases/$(database)/documents/forms/$(resource.data.formId)).data.ownerId == request.auth.uid;
      
      // Nobody can update a response once it is submitted to preserve data integrity.
      allow update: if false;
    }

    match /templates/{templateId} {
      // All users can read and list templates.
      allow get, list: if true;
      // Writing templates is restricted (e.g., admin-only, handled by Cloud Functions).
      allow write: if false; 
    }
  }
}