firestore.rules

rules_version = '2';

service cloud.firestore {
  match /databases/{database}/documents {

    // License documents — keyed by SHA-256 hash of the license key
    match /licenses/{keyHash} {

      // Admin (Adnan@thothica.com): full read/write/delete access
      // Authenticated via Firebase Auth (Google Sign-in from admin portal)
      allow read, write: if request.auth != null
                         && request.auth.token.email.lower() == "adnan@thothica.com";

      // App client (unauthenticated): can read any license doc.
      // The SHA-256 hash acts as the secret — you can't enumerate
      // documents without knowing the original license key.
      allow read: if true;

      // App client (unauthenticated): one-time machine binding.
      // - machine_id must currently be empty ("")
      // - only the machine_id field may be changed
      // - new value must be a non-empty string
      allow update: if resource.data.machine_id == ""
                    && request.resource.data.machine_id is string
                    && request.resource.data.machine_id.size() > 0
                    && request.resource.data.diff(resource.data)
                       .affectedKeys().hasOnly(["machine_id"]);

      // Non-admin: no creates or deletes
      allow create, delete: if false;
    }

    // Deny everything else by default
    match /{document=**} {
      allow read, write: if false;
    }
  }
}