firestore.rules

rules_version = '2';

service cloud.firestore {
  match /databases/{database}/documents {

    // Helper functions
    function isAuthenticated() {
      return request.auth != null;
    }

    // Super Admin check based on token email registry
    function isSuperAdmin() {
      return isAuthenticated() && 
             request.auth.token != null &&
             'email' in request.auth.token && 
             request.auth.token.email != null && (
        request.auth.token.email.lower() == 'enterspaceindia@gmail.com' || 
        request.auth.token.email.lower() == 'piyushkumrsingh23399@gmail.com' ||
        request.auth.token.email.lower() == 'nyayasahayakhelp@gmail.com'
      );
    }

    // General Admin check: Safely evaluate identity node
    function isAdmin() {
      return isSuperAdmin() || (
        isAuthenticated() && 
        exists(/databases/$(database)/documents/users/$(request.auth.uid)) && 
        get(/databases/$(database)/documents/users/$(request.auth.uid)).data.get('isAdmin', false) == true
      );
    }

    // GLOBAL ADMIN OVERRIDE
    match /{document=**} {
      allow read, write: if isSuperAdmin();
    }

    // Users collection: Identity Registry
    match /users/{userId} {
      allow get: if isAuthenticated();
      allow list: if isAdmin();
      allow create: if isAuthenticated() && userId == request.auth.uid;
      allow update: if isAuthenticated() && (userId == request.auth.uid || isAdmin());
      allow delete: if isAdmin();
    }

    // Notifications collection: Institutional Alerts
    match /notifications/{notificationId} {
      allow get: if isAuthenticated() && resource.data.userId == request.auth.uid;
      allow list: if isAuthenticated() && request.query.limit <= 100 && request.query.filters.userId == request.auth.uid;
      allow list: if isAdmin();
      allow create: if isAuthenticated();
      allow update, delete: if isAuthenticated() && resource.data.userId == request.auth.uid;
    }

    // Transactions collection: Statutory Ledger
    match /transactions/{transactionId} {
      allow get: if isAuthenticated() && resource.data.userId == request.auth.uid;
      // Additive rule splitting for query provability
      allow list: if isAuthenticated() && request.query.filters.userId == request.auth.uid;
      allow list: if isAdmin();
      allow create: if isAuthenticated();
    }

    // Posts collection: Community Transmissions (Publicly Readable)
    match /posts/{postId} {
      allow get, list: if true;
      allow create: if isAuthenticated();
      allow update, delete: if isAuthenticated() && (request.resource.data.authorUid == request.auth.uid || isAdmin());
    }

    // Advocates collection: Professional Registry (Publicly Readable)
    match /advocates/{advocateId} {
      allow get, list: if true;
      allow write: if isAuthenticated() && (advocateId == request.auth.uid || isAdmin());
    }
  }
}