firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    
    // Reusable functions for role-based access control
    function isAuthenticated() {
      return request.auth != null;
    }
    
    function isTeacher() {
      return isAuthenticated() && get(/databases/$(database)/documents/users/$(request.auth.uid)).data.role == 'teacher';
    }
    
    function isStudent() {
      return isAuthenticated() && get(/databases/$(database)/documents/users/$(request.auth.uid)).data.role == 'student';
    }

    // Users Collection
    // Users can read their own profile; teachers can read all profiles for class management
    // Users can only edit their own profile
    match /users/{userId} {
      allow read: if isAuthenticated() && (request.auth.uid == userId || isTeacher());
      allow write: if isAuthenticated() && request.auth.uid == userId;
    }

    // Courses Collection
    // Students can read courses, but only teachers can create/update/delete them
    match /courses/{courseId} {
      allow read: if isAuthenticated();
      allow write: if isTeacher();
    }

    // Enrollments Collection
    // Students can read their own enrollments. They can only create an enrollment for themselves.
    // Teachers can read all enrollments for their courses.
    match /enrollments/{enrollmentId} {
      allow read: if isAuthenticated() && (request.auth.uid == resource.data.studentId || isTeacher());
      allow create: if isStudent() && request.resource.data.studentId == request.auth.uid;
      allow update, delete: if isTeacher();
    }

    // Default deny
    match /{document=**} {
      allow read, write: if false;
    }
  }
}