rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {

    // Per-human membership mirror maintained by Orion's service account.
    // Locked from clients so the membership list cannot leak or be mutated.
    match /humans/{humanId} {
      allow read, write: if false;
    }

    // Particles: caller must be a current member of the network in the path.
    // get() on the mirror is cached across rule evaluations within a single
    // request, so this costs 1 billed read per request regardless of query size.
    match /networks/{networkId}/children/{particleId=**} {
      allow read, write: if request.auth != null
        && networkId in get(/databases/$(database)/documents/humans/$(request.auth.uid)).data.networks;
    }
  }
}