firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    
    // --- Helper Functions ---
    function isSignedIn() {
      return request.auth != null;
    }
    
    function getUserData() {
      let u = get(/databases/$(database)/documents/users/$(request.auth.uid));
      return u != null ? u.data : null;
    }
    
    function hasRole(role) {
      return isSignedIn() && getUserData() != null && getUserData().role == role;
    }

    // --- Colleges Collection ---
    match /colleges/{collegeId} {
      allow read: if true; 
      allow write: if hasRole('admin') || hasRole('superadmin');
    }

    // --- Users Collection ---
    match /users/{userId} {
      allow read: if true; 
      allow create: if isSignedIn() && (request.auth.uid == userId);
      allow update: if hasRole('admin') || hasRole('superadmin') || 
                   (request.auth.uid == userId && 
                    request.resource.data.diff(resource.data).affectedKeys().hasOnly(['xp', 'uploads', 'downloads', 'notesCount', 'name', 'avatar', 'views_activity']));
      allow delete: if hasRole('admin') || hasRole('superadmin');
    }

    // --- Consolidated Notes Collection ---
    match /notes/{noteId} {
      // Access Rule: Public read for approved/verified, or signed in users
      allow read: if true; // Everyone can see counts/metadata

      // Creation Rule: Signed in users can upload
      allow create: if isSignedIn();

      // Update Rule: Allow anyone to increment stats, full edit for admins/uploader
      allow update: if hasRole('admin') || hasRole('superadmin') || 
                    (hasRole('coadmin') && getUserData().collegeId == resource.data.collegeId) ||
                    (isSignedIn() && resource.data.uploadedBy == request.auth.uid) ||
                    (request.resource.data.diff(resource.data).affectedKeys().hasOnly(['views', 'downloads', 'likes', 'lastViewed', 'dislikes']));

      allow delete: if hasRole('admin') || hasRole('superadmin') || (isSignedIn() && resource.data.uploadedBy == request.auth.uid);

      // --- Engagement Subcollections ---
      match /likes/{userId} {
        allow read: if true;
        allow write: if isSignedIn() && request.auth.uid == userId;
      }
      match /dislikes/{userId} {
        allow read: if true;
        allow write: if isSignedIn() && request.auth.uid == userId;
      }
      match /engagement/{userId} {
        allow read: if true;
        allow write: if isSignedIn() && request.auth.uid == userId;
      }
    }

    // --- Role Invites ---
    match /role_invites/{emailId} {
      allow read, delete: if isSignedIn();
      allow write: if hasRole('admin') || hasRole('superadmin');
    }

    // --- Analytics (Global Standard) ---
    match /analytics/{docId} {
      allow read: if true;
      allow write: if true; 
    }

    // --- Presence ---
    match /presence/{userId} {
      allow read: if true;
      allow write: if isSignedIn() && request.auth.uid == userId;
    }

    // --- Legacy / Safety ---
    match /college_admins/{collegeId} {
      allow read: if true;
      allow write: if hasRole('admin') || hasRole('superadmin');
    }
  }
}