firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {

    // --- Helper Functions ---

    function isAuthenticated() {
      return request.auth != null;
    }

    function getUserRole() {
      return get(/databases/$(database)/documents/users/$(request.auth.uid)).data.role;
    }

    function isApproved() {
      let role = getUserRole();
      return role != 'PENDING' && role != null;
    }

    function isManager() {
      let role = getUserRole();
      return role == 'MANAGER' || role == 'ADMINISTRATOR';
    }

    // --- Collection Rules ---

    // 1. Users Collection
    match /users/{userId} {
      // Read: Managers/Employees/Self can see. Pending only see Self.
      allow read: if isAuthenticated() && (
        userId == request.auth.uid || 
        isApproved()
      );
      
      // Create: Self-creation (Signup) or Manager
      allow create: if isAuthenticated() && (request.auth.uid == userId || isManager());
      
      // Update:
      // Managers can update everything.
      // Users can update their own profile EXCEPT their role (Privilege Escalation Prevention).
      allow update: if isAuthenticated() && (
        isManager() || 
        (request.auth.uid == userId && request.resource.data.role == resource.data.role)
      );

      // Delete: Managers only
      allow delete: if isAuthenticated() && isManager();
    }

    // Customers Collection (formerly Categories)
    match /customers/{customerId} {
      allow read: if isAuthenticated() && isApproved();
      // Only Managers can manage customers
      allow write: if isAuthenticated() && isManager();
    }

    // Products Collection (New)
    match /products/{productId} {
      // Everyone can read products (needed for Drivers in Route view)
      allow read: if isAuthenticated() && isApproved();
      // Only Managers can manage products
      allow delete: if isAuthenticated() && isManager();
      allow create, update: if isAuthenticated() && isManager()
        && request.resource.data.name is string
        && request.resource.data.category is string
        && request.resource.data.price is number && request.resource.data.price >= 0
        && request.resource.data.quantity is number;
    }

    // Vehicles Collection (Fleet Management)
    match /vehicles/{vehicleId} {
      // Everyone can read vehicles (needed for viewing fleet/assignments)
      allow read: if isAuthenticated() && isApproved();
      // Only Managers can manage vehicles
      allow write: if isAuthenticated() && isManager();

      // Maintenance Subcollection
      match /maintenance/{recordId} {
        allow read: if isAuthenticated() && isApproved();
        allow write: if isAuthenticated() && isManager();
      }
    }

    // 3. Todos (Tasks)
    match /routes/{routeId} {
      allow read: if isAuthenticated() && isApproved();
      
      // Create: Managers only (Drivers should not be able to create routes manually)
      allow create: if isAuthenticated() && isManager();

      // Update:
      // Managers can update everything.
      // Assignees can update status/details BUT cannot reassign or change due date.
      allow update: if isAuthenticated() && isApproved() && (
        isManager() || 
        (
          resource.data.assignedTo == request.auth.uid && 
          request.resource.data.assignedTo == resource.data.assignedTo &&
          request.resource.data.dueDate == resource.data.dueDate
        )
      );

      // Delete: Managers only
      allow delete: if isAuthenticated() && isManager();
    }

    // 4. App Status (Audit Logs)
    match /app_status/{docId} {
      // Allow create for unauthenticated users (for login failure logs) but enforce schema
      allow create: if true 
        && request.resource.data.keys().hasAll(['type', 'timestamp', 'status'])
        && request.resource.data.type == 'LOGIN'
        && (request.resource.data.status == 'SUCCESS' || request.resource.data.status == 'FAILURE')
        && request.resource.data.size() < 20 // Prevent massive objects
        && request.resource.data.timestamp is timestamp
        && request.resource.data.timestamp > request.time - duration.value(60, 's'); // Simple "not too old" check to prevent backdating spam
      allow read, update, delete: if isAuthenticated() && isManager();
    }

    // 5. App Issues
    match /app_issues/{issueId} {
      allow read: if isAuthenticated() && (
        isManager() || 
        resource.data.userId == request.auth.uid
      );
      allow create: if isAuthenticated();
      allow update, delete: if isAuthenticated() && (
        isManager() || 
        resource.data.userId == request.auth.uid
      );
    }

    // 6. System Config
    // General read for all config docs (needed for Backup listing)
    match /config/{docId} {
       allow read: if isAuthenticated() && isApproved();
    }

    match /config/counters {
       // Allow write for Task Creation (Managers only)
       allow write: if isAuthenticated() && isManager();
    }

    match /config/settings {
       // Allow write for System Settings (Managers only)
       allow write: if isAuthenticated() && isManager();
    }

    match /config/seeding {
       // Allow write for Seeding Options (Managers only)
       allow write: if isAuthenticated() && isManager();
    }
  }
}