firestore.rules

rules_version = '2';

service cloud.firestore {
  match /databases/{database}/documents {
    // Helper functions
    function isAuthenticated() {
      return request.auth != null;
    }
    
    function isAdmin() {
      return isAuthenticated() && 
        get(/databases/$(database)/documents/users/$(request.auth.uid)).data.role == 'admin';
    }
    
    function isOwner(userId) {
      return isAuthenticated() && request.auth.uid == userId;
    }

    // Users collection
    match /users/{userId} {
      allow read: if request.auth != null;
      allow write: if isAdmin() || isOwner(userId);
      
      // Solved problems subcollection
      match /solvedProblems/{problemId} {
        allow read: if isAuthenticated();
        allow write: if isAdmin() || isOwner(userId);
      }

      // Solutions subcollections
      match /solutions/{problemId} {
        allow read: if isAuthenticated();
        allow write: if isAdmin() || isOwner(userId);
      }
    }

    // Daily stats collection - allow all authenticated users to read and write
    match /dailyStats/stats {
      allow read, write: if isAuthenticated();
    }

    // Collection group queries
    match /{path=**}/solvedProblems/{problemId} {
      allow read: if isAuthenticated();
      allow write: if isAdmin() || isOwner(path.split('/')[1]);
    }

    match /{path=**}/solutions/{problemId} {
      allow read: if isAuthenticated();
      allow write: if isAdmin() || isOwner(path.split('/')[1]);
    }

    // Problems collection
    match /problems/{problemId} {
      allow read: if isAuthenticated();
      allow write: if isAdmin();
    }
  }
}