firestore.rules

rules_version = '2';

service cloud.firestore {
  match /databases/{database}/documents {

    // ── Helpers ──────────────────────────────────────────────────────────────
    // An admin is identified by an allow-listed email OR a role:'admin' on their
    // own profile document. Keep ADMIN_EMAILS in sync with lib/admin.ts.
    function isAdmin() {
      return request.auth != null && (
        request.auth.token.email in ['admin@gmail.com'] ||
        (
          exists(/databases/$(database)/documents/users/$(request.auth.uid)) &&
          get(/databases/$(database)/documents/users/$(request.auth.uid)).data.get('role', 'user') == 'admin'
        )
      );
    }

    function isOwner(userId) {
      return request.auth != null && request.auth.uid == userId;
    }

    // ── Users ────────────────────────────────────────────────────────────────
    // A user may read/create their own profile and edit it — BUT may never
    // change their own `role` or `points`. Points are credited only by an admin
    // (the scanner), so a user can never award themselves points.
    match /users/{userId} {
      allow read:   if isAdmin() || isOwner(userId);
      allow create: if isOwner(userId);
      allow update: if isAdmin() || (
        isOwner(userId)
        && request.resource.data.get('role', 'user')  == resource.data.get('role', 'user')
        && request.resource.data.get('points', 0)     == resource.data.get('points', 0)
      );
      allow delete: if isAdmin();
    }

    // ── Events ───────────────────────────────────────────────────────────────
    // Any signed-in user may READ events (the public feed). Only an admin may
    // CREATE / UPDATE / DELETE them — this is the write rule for events created
    // from the admin panel. A created event must carry its core attributes so
    // the `events` collection is always well-formed.
    match /events/{eventId} {
      allow read:   if request.auth != null;
      allow create: if isAdmin()
        && request.resource.data.title is string
        && request.resource.data.title.size() > 0
        && request.resource.data.date is string;
      allow update, delete: if isAdmin();
    }

    // ── Registrations / tickets ──────────────────────────────────────────────
    // Doc id is `${userId}_${eventId}`. A user can read/create only their own,
    // and on create the ticket MUST be unused (attended:false, pointsAwarded:
    // false). Only an admin (scanner) may update a registration to mark
    // attendance. This is what guarantees points come from attendance, not
    // self-service.
    match /registrations/{registrationId} {
      allow read:   if isAdmin() || (request.auth != null && registrationId.split('_')[0] == request.auth.uid);
      allow create: if request.auth != null
        && registrationId.split('_')[0] == request.auth.uid
        && request.resource.data.attended == false
        && request.resource.data.pointsAwarded == false;
      allow update, delete: if isAdmin();
    }

    // ── Community ────────────────────────────────────────────────────────────
    // Posts are authored ONLY by admins/ODEJ; any signed-in user may read them.
    match /posts/{postId} {
      allow read:                 if request.auth != null;
      allow create, update, delete: if isAdmin();
    }

    // Reactions & saves: doc id is `${userId}_${postId}`. A user manages only
    // their own; admins may read all (for Community Analytics).
    // NOTE: `get` is authorized by the doc ID (works even when the doc doesn't
    // exist yet — the toggle reads before writing); `list` (queries) is
    // authorized by the document's userId field.
    match /post_reactions/{reactionId} {
      allow get:            if request.auth != null && (isAdmin() || reactionId.split('_')[0] == request.auth.uid);
      allow list:           if request.auth != null && (isAdmin() || resource.data.userId == request.auth.uid);
      allow create, update: if request.auth != null
        && reactionId.split('_')[0] == request.auth.uid
        && request.resource.data.userId == request.auth.uid;
      allow delete:         if request.auth != null && reactionId.split('_')[0] == request.auth.uid;
    }

    match /saved_posts/{savedId} {
      allow get:            if request.auth != null && (isAdmin() || savedId.split('_')[0] == request.auth.uid);
      allow list:           if request.auth != null && (isAdmin() || resource.data.userId == request.auth.uid);
      allow create, update: if request.auth != null
        && savedId.split('_')[0] == request.auth.uid
        && request.resource.data.userId == request.auth.uid;
      allow delete:         if request.auth != null && savedId.split('_')[0] == request.auth.uid;
    }

    // Comments: any signed-in user may read and post a comment as themselves
    // (non-empty, max 500 chars). Comments are immutable (no edit). The author
    // or an admin may delete. Whether a post accepts comments is enforced in the
    // UI (post.commentsEnabled); rules keep ownership + size guarantees.
    match /comments/{commentId} {
      allow read:   if request.auth != null;
      allow create: if request.auth != null
        && request.resource.data.userId == request.auth.uid
        && request.resource.data.text is string
        && request.resource.data.text.size() > 0
        && request.resource.data.text.size() <= 500;
      allow delete: if isAdmin() || (request.auth != null && resource.data.userId == request.auth.uid);
    }
  }
}