firestore.rules

rules_version = '2';

service cloud.firestore {
  match /databases/{database}/documents {
    // Helper function to check if user is authenticated
    function isAuthenticated() {
      return request.auth != null;
    }
    
    // Helper function to check if user has admin/super role
    // NOTE: This assumes custom claims are set OR we check a user document.
    // Since custom claims are better for security but require backend setup,
    // we'll check the 'authors' collection for role as per the app's structure.
    function isAdmin() {
      return isAuthenticated() && 
        exists(/databases/$(database)/documents/authors/$(request.auth.uid)) &&
        (get(/databases/$(database)/documents/authors/$(request.auth.uid)).data.role in ['admin', 'super']);
    }

    function isSuperAdmin() {
      return isAuthenticated() &&
        exists(/databases/$(database)/documents/authors/$(request.auth.uid)) &&
        get(/databases/$(database)/documents/authors/$(request.auth.uid)).data.role == 'super';
    }

    // Default: Deny all
    match /{document=**} {
      allow read, write: if false;
    }
    
    // Articles: Public read, Admin write
    match /articles/{articleId} {
      allow read: if true;
      allow create: if isAdmin() && (
        (request.resource.data.authorUID == request.auth.uid &&
          request.resource.data.authorRef == /databases/$(database)/documents/authors/$(request.auth.uid) &&
          request.resource.data.authorName == get(/databases/$(database)/documents/authors/$(request.auth.uid)).data.name) ||
        (exists(/databases/$(database)/documents/articleTrash/$(articleId)) &&
          request.resource.data == get(/databases/$(database)/documents/articleTrash/$(articleId)).data.article &&
          !existsAfter(/databases/$(database)/documents/articleTrash/$(articleId)))
      );
      allow update: if isAdmin() &&
        !request.resource.data.diff(resource.data).affectedKeys()
          .hasAny(['authorUID', 'authorRef', 'authorName']);
      allow delete: if isAdmin() &&
        existsAfter(/databases/$(database)/documents/articleTrash/$(articleId)) &&
        getAfter(/databases/$(database)/documents/articleTrash/$(articleId)).data.article == resource.data;
    }

    // Deleted articles: admins can restore them or explicitly remove them forever.
    match /articleTrash/{articleId} {
      allow read: if isAdmin();
      allow create: if isAdmin() &&
        request.resource.data.keys().hasOnly(['article', 'deletedAt', 'deletedBy']) &&
        request.resource.data.deletedBy == request.auth.uid &&
        request.resource.data.deletedAt == request.time &&
        exists(/databases/$(database)/documents/articles/$(articleId)) &&
        request.resource.data.article == get(/databases/$(database)/documents/articles/$(articleId)).data &&
        !existsAfter(/databases/$(database)/documents/articles/$(articleId));
      allow update: if false;
      allow delete: if isAdmin();
    }
    
    // News: Public read, Admin write
    // Removed as part of News functionality removal
    
    // Authors/Team: public read; privileged role changes stay privileged.
    match /authors/{userId} {
      allow read: if true;
      allow create: if request.resource.data.uid == userId &&
        (isSuperAdmin() || (isAdmin() && request.resource.data.role != 'super'));
      allow update: if isSuperAdmin() ||
        (isAdmin() && resource.data.role != 'super' && request.resource.data.role != 'super') ||
        (isAuthenticated() && request.auth.uid == userId &&
          request.resource.data.uid == resource.data.uid &&
          request.resource.data.role == resource.data.role);
      // Team members are deleted by the server so Auth and Firestore stay in sync.
      allow delete: if false;
    }

    // Assets: Authenticated users can read/write
    match /assets/{assetId} {
      allow read: if isAuthenticated();
      allow write: if isAuthenticated();
    }


    // Meta (Stats): Authenticated users can read
    match /meta/{docId} {
      allow read: if isAuthenticated();
      allow write: if isAdmin();
    }

    // Asset Index: Authenticated users can read (for search/stats)
    match /assets_index/{docId} {
      allow read: if isAuthenticated();
    }
  }
}