firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {

    // Helper function: Check if user is authenticated
    function isAuthenticated() {
      return request.auth != null;
    }

    // Helper function: Check if user is admin (checks user document role)
    function isAdmin() {
      return isAuthenticated() &&
             get(/databases/$(database)/documents/users/$(request.auth.uid)).data.role == 'admin';
    }

    // Helper function: Check if user owns the resource
    function isOwner(userId) {
      return isAuthenticated() &&
             request.auth.uid == userId;
    }

    // User profiles
    match /users/{userId} {
      allow read: if isOwner(userId) || isAdmin();
      allow write: if isOwner(userId);
      // Allow admins to update any user profile (for member level changes, role changes, etc.)
      allow update: if isAdmin();

      // User's chats
      match /chats/{chatId} {
        allow read, write: if isOwner(userId);

        // Chat messages
        match /messages/{messageId} {
          allow read, write: if isOwner(userId);
        }
      }
    }

    // Context sources (admin manages, all authenticated users can read)
    match /contextSources/{sourceId} {
      allow read: if isAuthenticated();
      allow write: if isAdmin();
    }

    // Chunks (read-only for authenticated users, system writes)
    match /chunks/{chunkId} {
      allow read: if isAuthenticated();
      allow write: if false; // Only backend functions can write
    }

    // System configuration (admin only)
    match /systemConfig/{doc} {
      allow read: if isAdmin();
      allow write: if isAdmin();
    }

    // System statistics cache (read by admins, write by backend functions)
    match /systemStats/{doc} {
      allow read: if isAdmin();
      allow write: if false; // Only backend functions can write
    }

    // Journeys (read by authenticated users, write by admins)
    match /journeys/{journeyId} {
      allow read: if isAuthenticated();
      allow write: if isAdmin();
    }
  }
}