firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    
    // Helper function to check if user is authenticated
    function isAuthenticated() {
      return request.auth != null;
    }
    
    // Helper function to check if user is admin
    function isAdmin() {
      return isAuthenticated() && 
             get(/databases/$(database)/documents/users/$(request.auth.uid)).data.role == 'admin';
    }
    
    // Helper function to check if user is admin or agent
    function isAdminOrAgent() {
      return isAuthenticated() && 
             (get(/databases/$(database)/documents/users/$(request.auth.uid)).data.role == 'admin' ||
              get(/databases/$(database)/documents/users/$(request.auth.uid)).data.role == 'agent');
    }
    
    // Helper function to check if user is agent (not admin)
    function isAgent() {
      return isAuthenticated() && 
             get(/databases/$(database)/documents/users/$(request.auth.uid)).data.role == 'agent';
    }
    
    // Helper function to check if user owns the document
    function isOwner(userId) {
      return isAuthenticated() && request.auth.uid == userId;
    }
    
    // Users collection
    match /users/{userId} {
      // Anyone can read user documents (for public profiles)
      // This allows viewing agent profiles on listing pages
      allow read: if true;
      
      // Users can only create/update their own document
      allow create: if isOwner(userId);
      allow update: if isOwner(userId);
      
      // Only allow role changes by existing admins (prevent self-promotion)
      allow update: if isAdmin();
      
      // No deletion of user documents
      allow delete: if false;
    }
    
    // Listings collection
    match /listings/{listingId} {
      // Anyone can read listings (public access for website)
      // The service layer filters to only show active listings
      allow read: if true;
      
      // CRITICAL: Admins and agents can create listings, but agents MUST have status='pending' and pendingApproval=true
      allow create: if isAdminOrAgent() &&
                      request.resource.data.createdBy == request.auth.uid &&
                      request.resource.data.title is string &&
                      request.resource.data.description is string &&
                      request.resource.data.price is number &&
                      request.resource.data.price > 0 &&
                      request.resource.data.location is map &&
                      // If agent, force status='pending' and pendingApproval=true
                      ((isAgent() && 
                        request.resource.data.status == 'pending' &&
                        request.resource.data.pendingApproval == true) ||
                       // If admin, allow any valid status
                       (!isAgent() && 
                        request.resource.data.status in ['active', 'sold', 'pending', 'rented', 'pledged']));
      
      // CRITICAL: Admin and agent can update, but with different permissions
      allow update: if isAdminOrAgent() &&
                      (
                       // CASE 1: Admin can update ANY listing (for approval/rejection)
                       isAdmin() ||
                       // CASE 2: Agent can only update their own listings, with restrictions
                       (isAgent() && resource.data.createdBy == request.auth.uid &&
                        // CONDITION 1: Agent requesting deletion (pendingDelete=true)
                        (request.resource.data.pendingDelete == true && 
                         request.resource.data.pendingApproval == true) ||
                        // CONDITION 2: Agent updating normally (not requesting deletion)
                        (request.resource.data.pendingDelete != true &&
                         request.resource.data.pendingDelete != 'true' &&
                         // Status must stay pending or unchanged (cannot activate)
                         (request.resource.data.status == 'pending' || 
                          request.resource.data.status == resource.data.status) &&
                         // pendingApproval must be true (cannot remove it)
                         (request.resource.data.pendingApproval == true || 
                          request.resource.data.pendingApproval == 'true')))
                      );
      
      // CRITICAL: Only admins can actually delete. Agents must use update to set pendingDelete=true
      // This prevents agents from bypassing the approval system
      // Admin can delete ANY listing (for rejection purposes)
      allow delete: if isAdmin();
    }
    
    // Projects collection
    match /projects/{projectId} {
      // Anyone can read projects (public access for website)
      allow read: if true;
      
      // Admins and agents can create projects
      allow create: if isAdminOrAgent() &&
                      request.resource.data.createdBy == request.auth.uid &&
                      request.resource.data.name is string &&
                      request.resource.data.description is string &&
                      request.resource.data.developer is string &&
                      request.resource.data.developedBy is string &&
                      request.resource.data.location is map &&
                      request.resource.data.status in ['upcoming', 'under-construction', 'completed', 'sold-out'];
      
      // Admin and agent who created the project can update it
      allow update: if isAdminOrAgent() &&
                      resource.data.createdBy == request.auth.uid;
      
      // Admin and agent who created the project can delete it
      allow delete: if isAdminOrAgent() &&
                      resource.data.createdBy == request.auth.uid;
    }
    
    // Deny all other database access
    match /{document=**} {
      allow read, write: if false;
    }
  }
}