firestore.rules

rules_version = "2";

service cloud.firestore {
  match /databases/{database}/documents {
    match /queteurs/{queteur} {
      allow write, update: if request.auth.uid != null
        && !exists(/databases/$(database)/documents/queteurs/$(request.auth.uid))
        && (request.resource.data.registration_approved == false || request.resource.data.registration_approved == null);
      allow read: if request.auth.uid != null;
    }

    // ul_queteur_stats_per_year is read server-side only (Admin SDK bypasses rules).
    // Client SDK access is forbidden since the migration to get-ul-queteur-ranking
    // and get-queteur-stats Cloud Functions.
    match /ul_queteur_stats_per_year/{doc} {
      allow read, write: if false;
    }

    match /{document=**} {
      allow write: if false;
      allow read: if request.auth.uid != null
        && get(/databases/$(database)/documents/queteurs/$(request.auth.uid)).data.registration_approved == true;
    }
  }
}