firestore.rules

rules_version = '2';

service cloud.firestore {
  match /databases/{database}/documents {
    
    function isAdmin() {
      return request.auth != null && get(/databases/$(database)/documents/users/$(request.auth.uid)).data.isAdmin == true;
    }
    
    function isAuthed() {
      return request.auth != null;
    }

    // `draft_state`: Everyone can read. Only admins can write.
    match /draft_state/{document=**} {
      allow read: if true;
      allow write: if isAdmin();
    }

    // `teams`: Everyone can read. Only backend or admins can write.
    match /teams/{teamNumber} {
      allow read: if true;
      allow write: if isAdmin();
    }

    // `users`: Everyone can read basic ranking info.
    // Users can update their own document but CANNOT modify protected fields.
    // Draft submissions go through the submitDraft Cloud Function (uses admin SDK).
    match /users/{userId} {
      allow read: if true;
      allow create: if isAuthed()
        && request.auth.uid == userId
        && request.resource.data.isAdmin == false
        && (!request.resource.data.keys().hasAny(['score']) || request.resource.data.score == 0)
        && (!request.resource.data.keys().hasAny(['rank']) || request.resource.data.rank == 0)
        && !request.resource.data.keys().hasAny(['seasons']);
      allow update: if (request.auth.uid == userId
        && !request.resource.data.diff(resource.data).affectedKeys().hasAny(['isAdmin', 'rank', 'score', 'seasons', 'teams', 'h2h']))
        || isAdmin();
      allow delete: if isAdmin();
    }

    // H2H weeks: everyone can read, only backend/admin writes
    match /h2h_weeks/{weekId} {
      allow read: if true;
      allow write: if isAdmin();

      match /picks/{userId} {
        allow read: if true;
        allow write: if false;
      }

      match /results/{matchupId} {
        allow read: if true;
        allow write: if false;
      }
    }

  }
}