firestore.rules

rules_version = '2';

service cloud.firestore {
  match /databases/{database}/documents {

    // --- Helper Functions ---
    function isSignedIn() {
      return request.auth != null;
    }

    function isOwner(userId) {
      return request.auth.uid == userId;
    }

    // Platform admin, granted via the Firebase custom claim `admin: true`.
    // Set out-of-band by the grant-admin script (Admin SDK) — clients can't
    // self-grant because the claim lives on the auth token, not Firestore.
    function isAdmin() {
      return request.auth != null && request.auth.token.admin == true;
    }

 
    match /users/{userId} {
      // Owner: full access to their own user doc and subcollections.
      allow read, write: if (isSignedIn() && isOwner(userId)) || (request.auth != null && request.auth.token.admin == true);

      // Teacher of this student's classroom: can READ the student's user doc
      // (so the dashboard can show name, role, classId, unlockedCourseIds).
      allow read: if isSignedIn()
        && resource.data.classId is string
        && exists(/databases/$(database)/documents/classrooms/$(resource.data.classId))
        && get(/databases/$(database)/documents/classrooms/$(resource.data.classId)).data.teacherId == request.auth.uid;

      // Teacher of this student's classroom: can UPDATE ONLY the
      // unlockedCourseIds field on the student's user doc (per-student
      // course access overrides). Nothing else.
      allow update: if isSignedIn()
        && resource.data.classId is string
        && exists(/databases/$(database)/documents/classrooms/$(resource.data.classId))
        && get(/databases/$(database)/documents/classrooms/$(resource.data.classId)).data.teacherId == request.auth.uid
        && request.resource.data.diff(resource.data).affectedKeys().hasOnly(['unlockedCourseIds']);

      // Teacher of this student's classroom: can CLEAR the student's classId
      // (kick out / remove from class). Only that one field, only to empty
      // string. Prevents accidental writes to anything else.
      allow update: if isSignedIn()
        && resource.data.classId is string
        && exists(/databases/$(database)/documents/classrooms/$(resource.data.classId))
        && get(/databases/$(database)/documents/classrooms/$(resource.data.classId)).data.teacherId == request.auth.uid
        && request.resource.data.diff(resource.data).affectedKeys().hasOnly(['classId'])
        && request.resource.data.classId == '';

      // Classmates: a signed-in user can READ another user's doc when both
      // share a classId (i.e. they're in the same classroom). Powers the
      // class-scoped leaderboard. Costs a single get() per read.
      allow read: if isSignedIn()
        && resource.data.classId is string
        && exists(/databases/$(database)/documents/users/$(request.auth.uid))
        && get(/databases/$(database)/documents/users/$(request.auth.uid)).data.classId == resource.data.classId;

      // Schoolmates: a signed-in user can READ another user's doc when both
      // share a non-empty schoolId. Powers the school-scoped leaderboard.
      // Costs a single get() per read.
      allow read: if isSignedIn()
        && resource.data.schoolId is string
        && resource.data.schoolId != ''
        && exists(/databases/$(database)/documents/users/$(request.auth.uid))
        && get(/databases/$(database)/documents/users/$(request.auth.uid)).data.schoolId == resource.data.schoolId;

      // School registrar: can READ user docs of users whose schoolId points to
      // a school they registered. Powers the "pending students" queue.
      allow read: if isSignedIn()
        && resource.data.schoolId is string
        && resource.data.schoolId != ''
        && exists(/databases/$(database)/documents/schools/$(resource.data.schoolId))
        && get(/databases/$(database)/documents/schools/$(resource.data.schoolId)).data.registrarId == request.auth.uid;

      // School registrar: APPROVE a pending join — set schoolJoinPending=false
      // on a user whose schoolId points to a school the caller registered.
      // Only that one field, only to false. Cannot touch other fields.
      allow update: if isSignedIn()
        && resource.data.schoolId is string
        && resource.data.schoolId != ''
        && exists(/databases/$(database)/documents/schools/$(resource.data.schoolId))
        && get(/databases/$(database)/documents/schools/$(resource.data.schoolId)).data.registrarId == request.auth.uid
        && request.resource.data.diff(resource.data).affectedKeys().hasOnly(['schoolJoinPending'])
        && request.resource.data.schoolJoinPending == false;

      // School registrar: REJECT a pending join — set schoolJoinPending=false
      // AND clear schoolId to ''. Only those two fields, with those exact
      // values. Lets the registrar push the user back to "no school" state.
      allow update: if isSignedIn()
        && resource.data.schoolId is string
        && resource.data.schoolId != ''
        && exists(/databases/$(database)/documents/schools/$(resource.data.schoolId))
        && get(/databases/$(database)/documents/schools/$(resource.data.schoolId)).data.registrarId == request.auth.uid
        && request.resource.data.diff(resource.data).affectedKeys().hasOnly(['schoolJoinPending', 'schoolId'])
        && request.resource.data.schoolJoinPending == false
        && request.resource.data.schoolId == '';

      // Subcollections (progress, economy, etc.):
      match /{document=**} {
        // Owner: full access.
        allow read, write: if (isSignedIn() && isOwner(userId)) || (request.auth != null && request.auth.token.admin == true);
        // Teacher of the user's classroom: read-only (dashboard needs lessons + stars).
        allow read: if isSignedIn()
          && exists(/databases/$(database)/documents/users/$(userId))
          && get(/databases/$(database)/documents/users/$(userId)).data.classId is string
          && exists(/databases/$(database)/documents/classrooms/$(get(/databases/$(database)/documents/users/$(userId)).data.classId))
          && get(/databases/$(database)/documents/classrooms/$(get(/databases/$(database)/documents/users/$(userId)).data.classId)).data.teacherId == request.auth.uid;
      }
    }
		
    // --- Legacy / Root Support ---
    // Keeps support for any direct root-level collections if still in use
    
  

    // --- Username Registry ---
    // Specifically for unique username lookups
    

    match /leaderboard/{docId} {
      // Publicly readable
      allow read: if true;
      // Writing is handled via Cloud Functions in production,
      // but if writing from client, strictly limit to the user's entry
      allow write: if request.auth.token.admin == true;
    }

    // --- Classrooms ---
    // Teachers can create and update their own classroom.
    // Students can read a classroom (to see the join code screen) and join it
    // by adding themselves to studentIds — but cannot modify anything else.
    match /classrooms/{classId} {
      // Any signed-in user can read a classroom (needed to look up join codes)
      allow read: if isSignedIn();

      // Only the teacher who owns the classroom can create or fully update it
      allow create: if isSignedIn() && request.resource.data.teacherId == request.auth.uid;
      allow update: if isSignedIn() && (
        // Teacher can update anything about their classroom
        resource.data.teacherId == request.auth.uid
        ||
        // Students can append their own uid to studentIds (join)
        (
          request.resource.data.diff(resource.data).affectedKeys().hasOnly(['studentIds'])
          && request.resource.data.studentIds.hasAll(resource.data.studentIds)
          && request.resource.data.studentIds.size() == resource.data.studentIds.size() + 1
          && request.auth.uid in request.resource.data.studentIds
        )
        ||
        // Students can remove themselves from studentIds (leave)
        (
          request.resource.data.diff(resource.data).affectedKeys().hasOnly(['studentIds'])
          && resource.data.studentIds.hasAll(request.resource.data.studentIds)
          && resource.data.studentIds.size() == request.resource.data.studentIds.size() + 1
          && request.auth.uid in resource.data.studentIds
          && !(request.auth.uid in request.resource.data.studentIds)
        )
      );

      // Only the owning teacher can delete a classroom
      allow delete: if isSignedIn() && resource.data.teacherId == request.auth.uid;

      // --- Assignments subcollection ---
      // Stored under classrooms/{classId}/assignments/{assignmentId}.
      // Only the classroom's teacher can create/update/delete assignments.
      // Members of the classroom (teacher + students) can read.
      match /assignments/{assignmentId} {
        function classroomData() {
          return get(/databases/$(database)/documents/classrooms/$(classId)).data;
        }
        function isClassTeacher() {
          return isSignedIn() && classroomData().teacherId == request.auth.uid;
        }
        function isClassMember() {
          return isSignedIn() && (
            classroomData().teacherId == request.auth.uid
            || request.auth.uid in classroomData().studentIds
          );
        }

        allow read: if isClassMember();
        allow create, update, delete: if isClassTeacher();

        // Comments on this assignment.
        match /comments/{commentId} {
          function isClassTeacherC() {
            return isSignedIn() && get(/databases/$(database)/documents/classrooms/$(classId)).data.teacherId == request.auth.uid;
          }
          function isClassMemberC() {
            return isSignedIn() && (
              get(/databases/$(database)/documents/classrooms/$(classId)).data.teacherId == request.auth.uid
              || request.auth.uid in get(/databases/$(database)/documents/classrooms/$(classId)).data.studentIds
            );
          }
          allow read: if isClassMemberC();
          allow create: if isClassMemberC() && request.resource.data.authorId == request.auth.uid;
          allow delete: if isSignedIn() && (resource.data.authorId == request.auth.uid || isClassTeacherC());
          // Comments are write-once — no edits.
          allow update: if false;
        }
      }

      // --- Posts (teacher announcements / classroom stream) ---
      // Stored under classrooms/{classId}/posts/{postId}.
      // Only the classroom's teacher can post or delete.
      // Members of the classroom (teacher + students) can read.
      match /posts/{postId} {
        function classroomData() {
          return get(/databases/$(database)/documents/classrooms/$(classId)).data;
        }
        function isClassTeacher() {
          return isSignedIn() && classroomData().teacherId == request.auth.uid;
        }
        function isClassMember() {
          return isSignedIn() && (
            classroomData().teacherId == request.auth.uid
            || request.auth.uid in classroomData().studentIds
          );
        }

        allow read: if isClassMember();
        allow create, update, delete: if isClassTeacher();

        // Comments on this post.
        match /comments/{commentId} {
          function isClassTeacherC() {
            return isSignedIn() && get(/databases/$(database)/documents/classrooms/$(classId)).data.teacherId == request.auth.uid;
          }
          function isClassMemberC() {
            return isSignedIn() && (
              get(/databases/$(database)/documents/classrooms/$(classId)).data.teacherId == request.auth.uid
              || request.auth.uid in get(/databases/$(database)/documents/classrooms/$(classId)).data.studentIds
            );
          }
          allow read: if isClassMemberC();
          allow create: if isClassMemberC() && request.resource.data.authorId == request.auth.uid;
          allow delete: if isSignedIn() && (resource.data.authorId == request.auth.uid || isClassTeacherC());
          allow update: if false;
        }
      }
    }

    // --- Schools ---
    // Code2Coder's school registry, gated by an admin-approval workflow.
    //   GET:    single-doc fetch by id is public — a school's name/location
    //           isn't sensitive, and members need to resolve their schoolId
    //           regardless of its review status. Discoverability is controlled
    //           by LIST, not GET.
    //   LIST:   only approved schools are publicly enumerable. A registrar can
    //           list their own (any status); admins can list anything. Firestore
    //           validates the query constraints against this rule, so the public
    //           list MUST filter status=='approved' and registrar lists MUST
    //           filter registrarId==uid, or the whole query is denied.
    //   CREATE: only a signed-in teacher, only for their own id, and the doc
    //           MUST start status=='pending' — teachers can't self-approve.
    //   UPDATE: the registrar may edit their school but NOT flip its status;
    //           only an admin can change status (approve/reject). Admins may
    //           also edit anything.
    //   DELETE: registrar or admin.
    match /schools/{schoolId} {
      allow get: if true;

      allow list: if resource.data.status == 'approved'
        || (isSignedIn() && resource.data.registrarId == request.auth.uid)
        || isAdmin();

      allow create: if isSignedIn()
        && request.resource.data.registrarId == request.auth.uid
        && request.resource.data.status == 'pending'
        && exists(/databases/$(database)/documents/users/$(request.auth.uid))
        && get(/databases/$(database)/documents/users/$(request.auth.uid)).data.role == 'teacher';

      allow update: if isAdmin()
        || (isSignedIn()
            && resource.data.registrarId == request.auth.uid
            && request.resource.data.status == resource.data.status);

      allow delete: if isAdmin()
        || (isSignedIn() && resource.data.registrarId == request.auth.uid);
    }

    // --- AI Feedback Cache ---
    // Written exclusively by Cloud Functions (admin SDK bypasses these rules).
    // Clients have no direct access — feedback is always proxied through the function.
    match /feedbackCache/{cacheKey} {
      allow read, write: if false;
    }

    // --- Global Deny Fallback ---
    match /{document=**} {
      allow read, write: if false;
    }
  }
}