One YAML spec.
Your entire Firestore data layer.

// GENERATED by firepack — do not edit.

import 'enums.dart';

class Post {
  final String id;
  final String organizationId;
  final String title;
  final PostStatus status;
  final DateTime createdAt;

  const Post({
    required this.id,
    required this.organizationId,
    required this.title,
    this.status = PostStatus.draft,
    required this.createdAt,
  });

  Post copyWith({String? id, String? title, PostStatus? status, ...}) =>
      Post(id: id ?? this.id, ...);

  // Pure JSON — for REST APIs, hashing, snapshot tests.
  Map<String, dynamic> toJson() => {
    'id': id, 'title': title, 'status': status.toJson(),
    'createdAt': createdAt.toIso8601String(), ...
  };
  factory Post.fromJson(Map<String, dynamic> json) => ...;

  // Firestore-native — DateTime stays DateTime,
  // cloud_firestore writes Timestamp.
  Map<String, dynamic> toFirestore() => {
    'id': id, 'title': title, 'status': status.toJson(),
    'createdAt': createdAt, ...
  };
  factory Post.fromFirestore(Map<String, dynamic> data) => Post(
    createdAt: _toDateTime(data['createdAt']),  // duck-typed
    ...
  );

  @override bool operator ==(Object other) => ... // value equality
  @override int get hashCode => Object.hash(...);
}

// GENERATED by firepack — do not edit.

import 'package:cloud_firestore/cloud_firestore.dart';
import 'package:flutter_riverpod/flutter_riverpod.dart';
import '../firestore_provider.dart';
import '../paths.dart';
import '../tenant_query.dart';
import '../models/post.dart';

class PostRepository {
  final FirebaseFirestore _firestore;
  PostRepository(this._firestore);

  Stream<List<Post>> watchByOrg(String orgId) =>
      _firestore.collection(FirestorePaths.posts)
          .scopedToOrg(orgId)
          .orderBy('createdAt', descending: true)
          .limit(50)
          .snapshots()
          .map((s) => s.docs.map(_fromDoc).toList());

  /// `merge: true` preserves server-only fields the model doesn't carry.
  /// `serverDefault: now` injects FieldValue.serverTimestamp() (only on full set).
  Future<void> add(Post doc, {bool merge = false}) {
    final data = doc.toFirestore();
    if (!merge) data['createdAt'] = FieldValue.serverTimestamp();
    return _firestore.collection(FirestorePaths.posts)
        .doc(doc.id).set(data, SetOptions(merge: merge));
  }

  Future<void> updateById(String id, Map<String, dynamic> fields) =>
      _firestore.collection(FirestorePaths.posts).doc(id).update(fields);

  Future<void> deleteById(String id) =>
      _firestore.collection(FirestorePaths.posts).doc(id).delete();
}

// Single DI seam — override firestoreProvider once, every repo follows.
final postRepositoryProvider = Provider<PostRepository>(
  (ref) => PostRepository(ref.watch(firestoreProvider)),
);

final postWatchByOrgProvider = StreamProvider.family<List<Post>, String>(
  (ref, orgId) => ref.watch(postRepositoryProvider).watchByOrg(orgId),
);

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    // Reusable helpers — emitted from the spec, one read per request.
    function isSignedIn()         { return request.auth != null; }
    function userDoc()            { return get(/databases/$(database)
                                      /documents/users/$(request.auth.uid)).data; }
    function getUserOrgId()       { return userDoc().organizationId; }
    function isAdmin()            { return userDoc().role == 'admin'; }
    function isSupervisorOrAdmin() {
      let role = userDoc().role;
      return role == 'admin' || role == 'supervisor';
    }

    match /posts/{id} {
      allow read:   if isSignedIn() &&
                       (resource.data.organizationId == getUserOrgId() || isAdmin());
      allow create: if isSignedIn() && isSupervisorOrAdmin();
      allow update: if isSupervisorOrAdmin();
      allow delete: if false;
    }

    // Secure everything else by default
    match /{document=**} { allow read, write: if false; }
  }
}

{
  "indexes": [
    {
      "collectionGroup": "posts",
      "queryScope": "COLLECTION",
      "fields": [
        { "fieldPath": "organizationId", "order": "ASCENDING" },
        { "fieldPath": "status",         "order": "ASCENDING" },
        { "fieldPath": "createdAt",      "order": "DESCENDING" }
      ]
    }
  ],
  "fieldOverrides": []
}