firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {

    // Allow anyone to read playlists (assuming they are public)
    match /playlists/{playlistId} {
      allow read;

      // Allow authenticated users to create their own playlists
      allow create: if request.auth != null && request.resource.data.userId == request.auth.uid;

      // Allow authenticated users to delete their own playlists
      allow delete: if request.auth != null && request.auth.uid == resource.data.userId;
    }

    // Only allow one document per user in the currentplaylist collection
    match /currentplaylist/{userId} {
      allow read, write: if request.auth != null && request.auth.uid == userId;
      allow create: if request.auth != null
                   && !exists(/databases/$(database)/documents/currentplaylist/$(userId))
                   && request.auth.uid == userId;
    }

    // Allow authenticated users to read and write to /history/{userId} but deny deletions
    match /history/{userId}/songs/{document=**} {
      allow read, write: if request.auth != null && request.auth.uid == userId;
      allow delete: if request.auth != null
    }
    
    match /tokens/{docuemnt=**} {
      allow create: if true;
    }
  }
}