firestore.rules

rules_version = '2';

service cloud.firestore {
  match /databases/{database}/documents {
    
    // User Helper Functions
    function isSignedIn() {
      return request.auth != null;
    }
    
    function isAdmin() {
      return isSignedIn() && (
        get(/databases/$(database)/documents/users/$(request.auth.uid)).data.role == 'admin' ||
        get(/databases/$(database)/documents/users/$(request.auth.uid)).data.role == 'chiefAdmin'
      );
    }

    function isChiefAdmin() {
      return isSignedIn() && get(/databases/$(database)/documents/users/$(request.auth.uid)).data.role == 'chiefAdmin';
    }

    // Users Collection
    match /users/{userId} {
      allow read: if isSignedIn();
      allow create: if isChiefAdmin();
      allow update: if isSignedIn() && (
        // Only Chief Admin can update roles or status
        (isChiefAdmin()) ||
        // Regular users can only update their own profile (excluding sensitive fields)
        (request.auth.uid == userId && 
         !request.resource.data.diff(resource.data).affectedKeys().hasAny(['role', 'status', 'isVerified', 'isActive']))
      );
      allow delete: if isChiefAdmin();
    }

    // Notifications Collection (Broadcasts)
    match /notifications/{notificationId} {
      allow read: if isSignedIn();
      allow create: if isAdmin();
      allow update, delete: if false; // Immutable audit log
    }

    // Notification Logs
    match /notification_logs/{logId} {
      allow read: if isAdmin();
      allow write: if false; // System only (Cloud Functions)
    }

    // Incident Chats Collection
    match /incident_chats/{incidentId} {
      allow read: if isSignedIn();
      allow create: if isAdmin();
      allow update: if isSignedIn();
      
      match /messages/{messageId} {
        allow read: if isSignedIn();
        allow create: if isAdmin() || (isSignedIn() && exists(/databases/$(database)/documents/incident_chats/$(incidentId)));
        allow update, delete: if false;
      }
    }

    // Default deny
    match /{document=**} {
      allow read, write: if false;
    }
  }
}