firestore.rules

rules_version = '2';

service cloud.firestore {
  match /databases/{database}/documents {
    // Check if the user is authenticated
    function isAuthenticated() {
      return request.auth != null;
    }
    
    // Check if the user is the admin
    function isAdmin() {
      return isAuthenticated() && request.auth.token.email == 'vector.scalernset@gmail.com';
    }
    
    // Allow admin to read and write all documents
    match /{document=**} {
      allow read, write: if isAdmin();
    }
    
    // System config specifically for admin access
    match /systemConfig/{configId} {
      allow read: if isAuthenticated();
      allow write: if isAdmin();
    }
    
    // Specific rule for appSettings document
    match /systemConfig/appSettings {
      allow read: if true; // Everyone can read app settings
      allow write: if isAdmin(); // Only admin can write
    }
    
    // Users collection - additional specific rules
    match /users/{userId} {
      // Allow users to read/write their own documents
      allow read, write: if isAuthenticated() && request.auth.uid == userId;
      
      // Allow users to read/write their own purchases
      match /purchases/{purchaseId} {
        allow read, write: if isAuthenticated() && request.auth.uid == userId;
      }
      
      // Allow users to read/write their own completedTests
      match /completedTests/{testId} {
        allow read, write: if isAuthenticated() && request.auth.uid == userId;
      }
    }
    
    // Allow access to testResults collection for authenticated users
    match /testResults/{resultId} {
      // Allow users to read/write their own test results
      allow read: if isAuthenticated() && request.auth.uid == resource.data.userId;
      allow create: if isAuthenticated() && request.auth.uid == request.resource.data.userId;
      allow update, delete: if isAuthenticated() && request.auth.uid == resource.data.userId;
    }
    
    // Allow admin to read all purchases using collectionGroup queries
    match /{path=**}/purchases/{purchaseId} {
      allow read: if isAdmin();
    }
    
    // Allow admin to read all completed tests using collectionGroup queries
    match /{path=**}/completedTests/{testId} {
      allow read: if isAdmin();
    }
    
    // Test Series with subcollections
    match /testSeries/{testId} {
      allow read: if true; // Everyone can read test series
      allow create, update, delete: if isAdmin();
      
      // Allow access to questions subcollection
      match /questions/{questionId} {
        allow read: if true;
        allow create, update, delete: if isAdmin();
      }
    }
  }
}