rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {

    // Usuário lê/atualiza apenas o próprio documento
    match /users/{userId} {
      allow read, update: if request.auth != null && request.auth.uid == userId;
      allow create: if request.auth != null && request.auth.uid == userId;
      // Admin pode ler qualquer usuário (token de admin autenticado)
      allow read, write: if request.auth != null && request.auth.token.email == "experrdigilal@gmail.com";
    }

    // Extrações: usuário cria, nunca lê (só admin)
    match /extractions/{docId} {
      allow create: if request.auth != null;
      allow read, write: if request.auth != null && request.auth.token.email == "experrdigilal@gmail.com";
    }
  }
}
