firestore.rules

rules_version = '2';

service cloud.firestore {
  match /databases/{database}/documents {

    // Users: any signed-in user can read; only owner can write
    match /users/{uid} {
      allow read: if request.auth != null;
      allow write: if request.auth != null && request.auth.uid == uid;
    }

    // Posts: any signed-in user can read and write
    match /posts/{postId} {
      allow read, write: if request.auth != null;
    }

    // Organizations: any signed-in user can read; all writes go through API route
    match /organizations/{orgId} {
      allow read: if request.auth != null;
      allow write: if false;
    }

    // Invitations: doc ID is an unguessable UUID code, so reads are open.
    // Writes are admin-only (via API route).
    match /invitations/{code} {
      allow read: if true;
      allow write: if request.auth != null &&
        get(/databases/$(database)/documents/users/$(request.auth.uid)).data.role == "admin";
    }
  }
}