rules_version = '2';

service cloud.firestore {
  match /databases/{database}/documents {
    
    // Allow read access for any authenticated user.
    // Allow write access only for the user who owns the log.
    match /artifacts/{appId}/public/data/activity_log/{logId} {
      allow read: if request.auth != null;
      allow write: if request.auth != null && request.resource.data.userId == request.auth.uid;
    }
    
    // Allow users to manage their own device state.
    match /artifacts/{appId}/public/data/devices/{deviceId} {
      allow read, write: if request.auth != null;
    }

    // Default deny all other documents
    match /{document=**} {
      allow read, write: if false;
    }
  }
}