Welcome back

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {

    // Users collection — only own data
    match /users/{userId} {
      allow read, write: if request.auth != null
                         && request.auth.uid == userId;
    }

    // All HR collections — authenticated users own their data
    match /{collection}/{docId} {
      allow read: if request.auth != null
                  && (resource == null
                      || resource.data.userId == request.auth.uid);
      allow create: if request.auth != null
                    && request.resource.data.userId == request.auth.uid;
      allow update, delete: if request.auth != null
                             && resource.data.userId == request.auth.uid;
    }
  }
}