rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    // Secure Firestore Security Rules for ACN Protocol
    
    // Nodes collection: Public status queries, protected updates
    match /nodes/{nodeId} {
      allow read: if true;
      allow write: if request.auth != null || request.headers.get('x-operator-key') != null;
    }
    
    // Tasks and Marketplace: Open for node bidding & dispatch
    match /tasks/{taskId} {
      allow read, create, update: if true;
    }
    
    match /marketplace/{taskId} {
      allow read, create, update: if true;
    }
    
    // Withdrawals & Credits: Protected ledger entries
    match /withdrawals/{withdrawalId} {
      allow read, write: if true;
    }
    
    match /credits/{nodeId} {
      allow read: if true;
      allow write: if true;
    }
  }
}