rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {

    // Regla existente para usuarios
    match /usuarios/{userId} {
      allow read, write: if request.auth.uid == userId;

      // ← AGREGAR ESTO para push subscriptions
      match /pushSubscriptions/{subId} {
        allow read, write: if request.auth.uid == userId;
      }
    }

    // Ruta alternativa (fallback)
    match /pushSubscriptions/{docId} {
      allow read, write: if request.auth != null
        && docId.matches(request.auth.uid + '.*');
    }
  }
}