Premium Robux & Game Items

Firestore Security Rules

These rules control access to your Firestore database. Copy and paste these into your Firebase Console under Firestore > Rules.

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    // Helper function to check if user is authenticated
    function isAuthenticated() {
      return request.auth != null;
    }
    
    // Helper function to check if user is admin
    function isAdmin() {
      return isAuthenticated() && 
        exists(/databases/$(database)/documents/admins/$(request.auth.token.email));
    }
    
    // Helper function to check if user owns the document
    function isOwner(userId) {
      return isAuthenticated() && request.auth.uid == userId;
    }
    
    // Users collection rules
    match /users/{userId} {
      allow read, write: if isOwner(userId) || isAdmin();
      allow create: if isAuthenticated();
      allow list: if isAdmin();
    }
    
    // Orders collection rules
    match /orders/{orderId} {
      allow create: if isAuthenticated();
      allow read: if isOwner(resource.data.userId) || isAdmin();
      allow update, delete: if isOwner(resource.data.userId) || isAdmin();
      allow list: if isAdmin();
    }
    
    // Admins collection rules
    match /admins/{adminEmail} {
      allow read, write: if isAdmin();
      allow list: if isAdmin();
    }
  }
}