firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    
    // ========================================
    // HELPER FUNCTIONS
    // ========================================
    
    // Check if user is authenticated
    function isAuthenticated() {
      return request.auth != null;
    }
    
    // Check if user owns the document
    function isOwner(userId) {
      return isAuthenticated() && request.auth.uid == userId;
    }
    
    // Check if user is an admin/owner
    function isOwner() {
      return isAuthenticated() && 
             (request.auth.token.email == 'info@defrag.app' || 
              request.auth.token.email == 'chadowen93@gmail.com');
    }
    
    // Check if user has paid
    function hasPaid() {
      return isAuthenticated() && 
             get(/databases/$(database)/documents/users/$(request.auth.uid)).data.paymentVerified == true;
    }
    
    // ========================================
    // USER PROFILES
    // ========================================
    
    match /users/{userId} {
      // Users can read their own profile
      // Owners can read all profiles
      allow read: if isOwner(userId) || isOwner();
      
      // Users can create/update their own profile
      // Owners can create/update any profile
      allow create, update: if isOwner(userId) || isOwner();
      
      // Only owners can delete profiles
      allow delete: if isOwner();
    }
    
    // ========================================
    // RELATIONSHIP MANUALS
    // ========================================
    
    // Rule for the new metadata collection
    match /manual_metadata/{manualId} {
      allow read, write: if request.auth != null && request.auth.uid == resource.data.userId;
      allow create: if request.auth != null && request.auth.uid == request.resource.data.userId;
    }

    // Existing rule for full manuals
    match /manuals/{manualId} {
      allow read, write: if request.auth != null && request.auth.uid == resource.data.userId;
      allow create: if request.auth != null && request.auth.uid == request.resource.data.userId;
    }
    
    // ========================================
    // ADMIN COLLECTIONS
    // ========================================
    
    match /admin/{document=**} {
      allow read, write: if isOwner();
    }
    
    // ========================================
    // ANALYTICS & LOGS (Read-only for owners)
    // ========================================
    
    match /analytics/{document=**} {
      allow read: if isOwner();
      allow write: if false; // Writes handled server-side only
    }
    
    match /logs/{document=**} {
      allow read: if isOwner();
      allow write: if false; // Writes handled server-side only
    }
    
    // ========================================
    // DENY ALL OTHER ACCESS
    // ========================================
    
    match /{document=**} {
      allow read, write: if false;
    }
  }
}