firestore.rules

rules_version = '2';

service cloud.firestore {
  match /databases/{database}/documents {
    
    // ─────────────────────────────────────────────
    // HELPER FUNCTIONS
    // ─────────────────────────────────────────────
    
    function isAuthenticated() {
      return request.auth != null;
    }
    
    function isOwner(userId) {
      return isAuthenticated() && request.auth.uid == userId;
    }
    
    function isAdmin() {
      return isAuthenticated() && 
        get(/databases/$(database)/documents/users/$(request.auth.uid)).data.role == 'admin';
    }

    // ─────────────────────────────────────────────
    // COLLECTION RULES
    // ─────────────────────────────────────────────

    // Products: Publicly readable (active only), Admin writeable
    match /products/{productId} {
      allow read: if isAdmin() || (resource == null || resource.data.status == 'active');
      allow write: if isAdmin();
    }

    // Categories & Types (Taxonomy)
    match /knowledgebase_categories/{catId} {
      allow read: if true;
      allow write: if isAdmin();
    }
    match /knowledgebase_articles/{artId} {
      allow read: if true;
      allow write: if isAdmin();
    }
    match /product_categories/{catId} {
      allow read: if true;
      allow write: if isAdmin();
    }
    match /product_types/{typeId} {
      allow read: if true;
      allow write: if isAdmin();
    }

    // Users: Owner or Admin
    match /users/{userId} {
      allow read: if isOwner(userId) || isAdmin();
      // Prevent users from changing their own role (privilege escalation)
      allow create: if isOwner(userId) && (!request.resource.data.keys().contains('role') || request.resource.data.role == 'customer');
      allow update: if isAdmin() || (isOwner(userId) && !request.resource.data.diff(resource.data).affectedKeys().hasAny(['role']));
    }

    // Carts: Owner only
    match /carts/{cartId} {
      allow read, write: if isAuthenticated() && (
        resource == null || resource.data.userId == request.auth.uid
      ) && request.resource.data.userId == request.auth.uid &&
      // Production Hardening: Prevent negative quantities in cart at the substrate layer
      request.resource.data.items.all(item, item.quantity > 0 && item.quantity < 1000);
    }

    // Orders: Owner or Admin
    match /orders/{orderId} {
      allow read: if isAuthenticated() && (
        resource.data.userId == request.auth.uid || isAdmin()
      );
      // Orders are created via server-side API routes (Admin SDK)
      allow create: if false; 
      allow update: if isAdmin();
      allow delete: if false; 
    }

    // Wishlists: Owner only
    match /wishlists/{wishlistId} {
      allow read, write: if isAuthenticated() && (
        resource == null || resource.data.userId == request.auth.uid
      ) && request.resource.data.userId == request.auth.uid;
    }

    // Support Tickets
    match /support_tickets/{ticketId} {
      allow read: if isAuthenticated() && (
        resource.data.userId == request.auth.uid || isAdmin()
      );
      // Tickets are created via server-side API routes
      allow create: if false;
      allow update: if isAdmin() || (
        isAuthenticated() && resource.data.userId == request.auth.uid && 
        request.resource.data.diff(resource.data).affectedKeys().hasOnly(['updatedAt'])
      );
    }
    
    match /ticket_messages/{messageId} {
      allow read: if isAuthenticated() && (
        resource.data.senderId == request.auth.uid || isAdmin() || 
        get(/databases/$(database)/documents/support_tickets/$(resource.data.ticketId)).data.userId == request.auth.uid
      );
      // Ensure users can only create messages for tickets they own
      allow create: if isAuthenticated() && (
        isAdmin() || 
        get(/databases/$(database)/documents/support_tickets/$(request.resource.data.ticketId)).data.userId == request.auth.uid
      );
    }

    // Inventory & Procurement: Admin only
    match /inventory_locations/{locId} {
      allow read, write: if isAdmin();
    }
    match /inventory_levels/{levelId} {
      allow read, write: if isAdmin();
    }
    match /suppliers/{supId} {
      allow read, write: if isAdmin();
    }
    match /purchase_orders/{poId} {
      allow read, write: if isAdmin();
    }
    match /transfers/{transferId} {
      allow read, write: if isAdmin();
    }

    // Marketing & Settings
    match /discounts/{discountId} {
      allow get: if true; // Public can check individual discount codes
      allow list: if isAdmin(); // Only admins can scrape/list all codes
      allow write: if isAdmin();
    }
    match /settings/{settingId} {
      allow get: if true;
      allow list: if isAdmin();
      allow write: if isAdmin();
    }
    match /collections/{collId} {
      allow read: if true;
      allow write: if isAdmin();
    }

    // System & Forensics
    match /hive_audit/{auditId} {
      allow read: if isAdmin();
      allow write: if false; // Only written via service layer (Admin SDK)
    }
    match /stripe_events/{eventId} {
      allow read: if isAdmin();
      allow write: if false; // Only written via service layer
    }
    match /digital_access_logs/{logId} {
      allow read: if isAdmin() || (isAuthenticated() && resource.data.userId == request.auth.uid);
      allow write: if false; // Only written via service layer
    }
    
    // Email Idempotency Ledger
    // TTL: 30 days (field: expiresAt). Firestore TTL policy must be set on this collection.
    // Privacy: stores only recipient email, subject, sentAt, expiresAt. No message content.
    // Replay safety: after TTL expiry, a new send is permitted (30d window exceeds all realistic retry windows).
    match /sent_emails/{emailId} {
      allow read: if isAdmin();
      allow write: if false; // Only written via Admin SDK (BrevoEmailService.markEmailSent)
    }

    // Default deny
    match /{path=**} {
      allow read, write: if false;
    }
  }
}