firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    
    // ========================================
    // COLLECTION: users
    // ========================================
    match /users/{userId} {
      // ✅ Cho phép đọc 1 user cụ thể
      allow get: if request.auth != null;
  
      // ✅ Cho phép list users nhưng giới hạn 50 kết quả
      allow list: if request.auth != null && 
                     request.query.limit <= 50;
  
      allow write: if request.auth != null && request.auth.uid == userId;
      
      // ========================================
      // SUBCOLLECTION: friends
      // ========================================
      match /friends/{friendId} {
        allow read: if request.auth != null && request.auth.uid == userId;
        
        // ✅ SỬA: Cho phép ghi khi user đang thêm bạn vào friends của mình
        // HOẶC khi user đang được thêm vào friends của người khác
        allow write: if request.auth != null && 
                        (request.auth.uid == userId || 
                         request.auth.uid == friendId);
        
        allow create, delete: if request.auth != null && 
                                 (request.auth.uid == userId || 
                                  request.auth.uid == friendId);
      }
      
      // ========================================
      // SUBCOLLECTION: friendRequests
      // ========================================
      match /friendRequests/{requestId} {
        allow read: if request.auth != null && request.auth.uid == userId;
        
        // ✅ Cho phép tạo friend request (người gửi tạo trong sentRequests của mình
        // và trong friendRequests của người nhận)
        allow create: if request.auth != null;
        
        // ✅ Cho phép xóa nếu là người nhận hoặc người gửi
        // SỬA: Dùng requestId thay vì resource.data.fromUserId để an toàn hơn
        allow delete: if request.auth != null && 
                         (request.auth.uid == userId || 
                          request.auth.uid == requestId);
      }
      
      // ========================================
      // SUBCOLLECTION: sentRequests
      // ========================================
      match /sentRequests/{requestId} {
        allow read: if request.auth != null && request.auth.uid == userId;
        
        // ✅ Cho phép ghi khi user đang tạo sent request của mình
        // HOẶC khi người khác xóa sent request (khi accept/decline)
        allow write: if request.auth != null && 
                        (request.auth.uid == userId || 
                         request.auth.uid == requestId);
        
        allow delete: if request.auth != null && 
                         (request.auth.uid == userId || 
                          request.auth.uid == requestId);
      }
      
      // ========================================
      // SUBCOLLECTION: blockedUsers
      // ========================================
      match /blockedUsers/{blockedUserId} {
        allow read, write: if request.auth != null && request.auth.uid == userId;
      }
    }
    
    // ========================================
    // COLLECTION: chats
    // ========================================
    match /chats/{chatId} {
      function isParticipant() {
        return request.auth != null && 
               request.auth.uid in resource.data.participants;
      }
      
      function isParticipantInNew() {
        return request.auth != null && 
               request.auth.uid in request.resource.data.participants;
      }
      
      // ✅ List operations - allow authenticated users to query
      allow list: if request.auth != null;
      
      // ✅ Get operations - check if user is participant
      allow get: if request.auth != null && 
                    (resource == null || isParticipant());
      
      allow create: if request.auth != null && 
                       isParticipantInNew() &&
                       request.resource.data.participants.size() == 2;
      
      allow update: if request.auth != null && isParticipant();
      allow delete: if request.auth != null && isParticipant();
      
      // ========================================
      // SUBCOLLECTION: messages
      // ========================================
      match /messages/{messageId} {
        allow read: if request.auth != null && (
          !exists(/databases/$(database)/documents/chats/$(chatId)) ||
          request.auth.uid in get(/databases/$(database)/documents/chats/$(chatId)).data.participants
        );
        
        allow create: if request.auth != null &&
                         request.auth.uid == request.resource.data.senderId &&
                         request.auth.uid in get(/databases/$(database)/documents/chats/$(chatId)).data.participants;
        
        allow update: if request.auth != null && 
                         request.auth.uid in get(/databases/$(database)/documents/chats/$(chatId)).data.participants;
        
        // Allow delete if:
        // 1. User is the sender (for recall feature)
        // 2. User is a participant AND message has expired (for self-destruct auto-delete)
        allow delete: if request.auth != null && (
          request.auth.uid == resource.data.senderId ||
          (request.auth.uid in get(/databases/$(database)/documents/chats/$(chatId)).data.participants &&
           resource.data.expiresAt != null &&
           request.time.toMillis() > resource.data.expiresAt)
        );
      }
    }
    
    // ========================================
    // COLLECTION: posts
    // ========================================
    match /posts/{postId} {
      // ✅ List operations - allow authenticated users to query
      allow list: if request.auth != null;
      
      // ✅ Get operations - check visibility
      allow get: if request.auth != null && 
                    (request.auth.uid in resource.data.visibleTo || 
                     request.auth.uid == resource.data.userId);
      
      allow create: if request.auth != null && 
                       request.auth.uid == request.resource.data.userId;
      
      allow update, delete: if request.auth != null && 
                               request.auth.uid == resource.data.userId;
      
      // ========================================
      // SUBCOLLECTION: reactions
      // ========================================
      match /reactions/{reactionId} {
        allow read: if request.auth != null;
        allow create: if request.auth != null && 
                         request.auth.uid == request.resource.data.userId;
        allow delete: if request.auth != null && 
                         request.auth.uid == resource.data.userId;
      }
    }
    
    // ========================================
    // COLLECTION: notifications
    // Used by Cloud Functions to send push notifications
    // ========================================
    match /notifications/{notificationId} {
      // Users can read their own notifications
      allow get: if request.auth != null && 
                    resource.data.targetUserId == request.auth.uid;
      
      // List notifications for current user
      allow list: if request.auth != null && 
                     request.query.where('targetUserId', '==', request.auth.uid);
      
      // Any authenticated user can create notifications
      // This allows client-side notification triggers
      allow create: if request.auth != null;
      
      // Only target user or admin can update/delete
      allow update, delete: if request.auth != null && 
                               resource.data.targetUserId == request.auth.uid;
    }
    
    // ========================================
    // COLLECTION: fcmTokens (user subcollection)
    // Stores FCM tokens for each user's devices
    // ========================================
    match /users/{userId}/fcmTokens/{tokenId} {
      // Only the user can read/write their own tokens
      allow read, write: if request.auth != null && 
                            request.auth.uid == userId;
    }
  }
}