firestore.rules

rules_version = '2';

service cloud.firestore {
  match /databases/{database}/documents {
    // Helper function to check if user is authenticated
    function isAuthenticated() {
      return request.auth != null;
    }

    function isCmsUser() {
      return isAuthenticated() &&
        exists(/databases/$(database)/documents/authors/$(request.auth.uid)) &&
        get(/databases/$(database)/documents/authors/$(request.auth.uid)).data.role in ['author', 'admin', 'super'];
    }

    function isModerator() {
      return isAuthenticated() &&
        exists(/databases/$(database)/documents/authors/$(request.auth.uid)) &&
        get(/databases/$(database)/documents/authors/$(request.auth.uid)).data.role == 'moderator';
    }

    function isStaff() {
      return isAuthenticated() &&
        exists(/databases/$(database)/documents/authors/$(request.auth.uid)) &&
        get(/databases/$(database)/documents/authors/$(request.auth.uid)).data.role in ['super', 'admin', 'author', 'moderator'];
    }

    function canModerate() {
      return isSuperAdmin() || isAdmin() || isModerator();
    }

    function isAllowedReaderPhoto(url) {
      return url is string && url.size() >= 1 && url.size() <= 1000 &&
        url.matches('^https://(firebasestorage\\.googleapis\\.com|([a-z0-9-]+\\.)?googleusercontent\\.com)/.*$');
    }

    function handleReservationKey(handle) {
      return handle.lower().replace('[-_0-9]+', '');
    }

    function confusableBrandKey(handle) {
      return handle.lower()
        .replace('1', 'l')
        .replace('4', 'a')
        .replace('9', 'p')
        .replace('[-_0-9]+', '');
    }

    // Protect official brand names and common impersonation qualifiers without
    // rejecting unrelated words such as "overlap" or "clapping".
    function isReservedBrandKey(key) {
      return key.matches('^(official|real|the|team|weare|my)?(lap|arclapain).*');
    }

    function canClaimHandle(handle) {
      let key = handleReservationKey(handle);
      let reservationPath = /databases/$(database)/documents/handleReservations/$(key);
      return (
        exists(reservationPath) &&
        get(reservationPath).data.ownerUid == request.auth.uid
      ) || (
        !exists(reservationPath) &&
        !isReservedBrandKey(key) &&
        !isReservedBrandKey(confusableBrandKey(handle))
      );
    }

    function isHandleSystemReady() {
      return exists(/databases/$(database)/documents/handleConfig/status) &&
        get(/databases/$(database)/documents/handleConfig/status).data.ready == true;
    }
    
    // Helper function to check if user has admin/super role
    // NOTE: This assumes custom claims are set OR we check a user document.
    // Since custom claims are better for security but require backend setup,
    // we'll check the 'authors' collection for role as per the app's structure.
    function isAdmin() {
      return isAuthenticated() && 
        exists(/databases/$(database)/documents/authors/$(request.auth.uid)) &&
        (get(/databases/$(database)/documents/authors/$(request.auth.uid)).data.role in ['admin', 'super']);
    }

    function isSuperAdmin() {
      return isAuthenticated() &&
        exists(/databases/$(database)/documents/authors/$(request.auth.uid)) &&
        get(/databases/$(database)/documents/authors/$(request.auth.uid)).data.role == 'super';
    }

    // Default: Deny all
    match /{document=**} {
      allow read, write: if false;
    }
    
    // Published articles are public. Drafts stay inside the CMS.
    match /articles/{articleId} {
      allow read: if resource.data.publish == true || isCmsUser();
      allow create: if isCmsUser() && (
        (request.resource.data.authorUID == request.auth.uid &&
          request.resource.data.authorRef == /databases/$(database)/documents/authors/$(request.auth.uid) &&
          request.resource.data.authorName == get(/databases/$(database)/documents/authors/$(request.auth.uid)).data.name) ||
        (exists(/databases/$(database)/documents/articleTrash/$(articleId)) &&
          request.resource.data == get(/databases/$(database)/documents/articleTrash/$(articleId)).data.article &&
          !existsAfter(/databases/$(database)/documents/articleTrash/$(articleId)))
      );
      allow update: if (isAdmin() || (isCmsUser() && resource.data.authorUID == request.auth.uid)) &&
        !request.resource.data.diff(resource.data).affectedKeys()
          .hasAny(['authorUID', 'authorRef', 'authorName']);
      allow delete: if (isAdmin() || (isCmsUser() && resource.data.authorUID == request.auth.uid)) &&
        existsAfter(/databases/$(database)/documents/articleTrash/$(articleId)) &&
        getAfter(/databases/$(database)/documents/articleTrash/$(articleId)).data.article == resource.data;
    }

    // Deleted articles: admins and authors (for their own articles) can restore or delete forever.
    match /articleTrash/{articleId} {
      allow read: if isCmsUser();
      allow create: if (isAdmin() || (isCmsUser() && request.resource.data.article.authorUID == request.auth.uid)) &&
        request.resource.data.keys().hasOnly(['article', 'deletedAt', 'deletedBy']) &&
        request.resource.data.deletedBy == request.auth.uid &&
        request.resource.data.deletedAt == request.time &&
        exists(/databases/$(database)/documents/articles/$(articleId)) &&
        request.resource.data.article == get(/databases/$(database)/documents/articles/$(articleId)).data &&
        !existsAfter(/databases/$(database)/documents/articles/$(articleId));
      allow update: if false;
      allow delete: if isAdmin() || (isCmsUser() && resource.data.article.authorUID == request.auth.uid);
    }
    
    // News: Public read, Admin write
    // Removed as part of News functionality removal
    
    // Private staff records. Public-safe fields are mirrored to publicAuthors.
    match /authors/{userId} {
      allow read: if isStaff() || (isAuthenticated() && request.auth.uid == userId);
      allow create: if request.resource.data.uid == userId &&
        (isSuperAdmin() || (isAdmin() && request.resource.data.role != 'super'));
      allow update: if
        resource.data.uid == userId &&
        request.resource.data.uid == userId &&
        !request.resource.data.diff(resource.data).affectedKeys().hasAny(['uid', 'handle']) &&
        (isSuperAdmin() ||
          (isAdmin() &&
            resource.data.role != 'super' &&
            request.resource.data.role == resource.data.role) ||
          (isAuthenticated() && request.auth.uid == userId &&
            request.resource.data.role == resource.data.role &&
            request.resource.data.diff(resource.data).affectedKeys().hasOnly([
              'avatar', 'name', 'city', 'job', 'biography', 'socials'
            ])));
      // Team members are deleted by the server so Auth and Firestore stay in sync.
      allow delete: if false;
    }

    // Private reader accounts. Public-safe identity fields live in publicProfiles.
    match /users/{userId} {
      allow get: if isAuthenticated() && (request.auth.uid == userId || canModerate());
      allow list: if canModerate();
      allow create: if isAuthenticated() &&
        isHandleSystemReady() &&
        request.auth.uid == userId &&
        request.auth.token.email is string &&
        request.resource.data.keys().hasOnly([
          'uid', 'email', 'displayName', 'photoURL', 'provider', 'handle', 'createdAt', 'updatedAt',
          'termsAcceptedAt', 'termsVersion', 'guidelinesAcceptedAt', 'guidelinesVersion'
        ]) &&
        request.resource.data.uid == userId &&
        request.resource.data.email == request.auth.token.email &&
        request.resource.data.displayName is string &&
        request.resource.data.displayName.size() >= 2 &&
        request.resource.data.displayName.size() <= 80 &&
        isAllowedReaderPhoto(request.resource.data.photoURL) &&
        request.resource.data.provider in ['password', 'google.com'] &&
        request.resource.data.handle is string &&
        request.resource.data.handle.matches('^[a-z0-9_-]{3,20}$') &&
        canClaimHandle(request.resource.data.handle) &&
        request.resource.data.displayName == request.resource.data.handle &&
        exists(/databases/$(database)/documents/riskAttestations/$(userId)) &&
        get(/databases/$(database)/documents/riskAttestations/$(userId)).data.uid == userId &&
        get(/databases/$(database)/documents/riskAttestations/$(userId)).data.verifiedAt >=
          request.time - duration.value(15, 'm') &&
        get(/databases/$(database)/documents/riskAttestations/$(userId)).data.expiresAt >= request.time &&
        existsAfter(/databases/$(database)/documents/handles/$(request.resource.data.handle)) &&
        getAfter(/databases/$(database)/documents/handles/$(request.resource.data.handle)).data.uid == userId &&
        request.resource.data.termsAcceptedAt == request.time &&
        request.resource.data.guidelinesAcceptedAt == request.time &&
        request.resource.data.termsVersion is string &&
        request.resource.data.guidelinesVersion is string &&
        request.resource.data.createdAt == request.time &&
        request.resource.data.updatedAt == request.time;
      allow update: if isAuthenticated() &&
        request.auth.uid == userId &&
        request.auth.token.email is string &&
        request.resource.data.diff(resource.data).affectedKeys().hasOnly([
          'email', 'displayName', 'photoURL', 'provider', 'handle', 'updatedAt',
          'termsAcceptedAt', 'termsVersion', 'guidelinesAcceptedAt', 'guidelinesVersion'
        ]) &&
        request.resource.data.uid == resource.data.uid &&
        request.resource.data.email == request.auth.token.email &&
        request.resource.data.displayName is string &&
        request.resource.data.displayName.size() >= 2 &&
        request.resource.data.displayName.size() <= 80 &&
        isAllowedReaderPhoto(request.resource.data.photoURL) &&
        request.resource.data.provider in ['password', 'google.com'] &&
        request.resource.data.handle is string &&
        ((resource.data.keys().hasAny(['termsAcceptedAt']) &&
            request.resource.data.termsAcceptedAt == resource.data.termsAcceptedAt &&
            request.resource.data.termsVersion == resource.data.termsVersion) ||
          (!resource.data.keys().hasAny(['termsAcceptedAt']) &&
            ((!request.resource.data.keys().hasAny(['termsAcceptedAt', 'termsVersion'])) ||
              (request.resource.data.termsAcceptedAt == request.time &&
                request.resource.data.termsVersion is string)))) &&
        ((resource.data.keys().hasAny(['guidelinesAcceptedAt']) &&
            request.resource.data.guidelinesAcceptedAt == resource.data.guidelinesAcceptedAt &&
            request.resource.data.guidelinesVersion == resource.data.guidelinesVersion) ||
          (!resource.data.keys().hasAny(['guidelinesAcceptedAt']) &&
            ((!request.resource.data.keys().hasAny(['guidelinesAcceptedAt', 'guidelinesVersion'])) ||
              (request.resource.data.guidelinesAcceptedAt == request.time &&
                request.resource.data.guidelinesVersion is string)))) &&
        // A handle may be claimed once during onboarding. A non-empty handle
        // must remain unchanged for the lifetime of the reader account.
        (
          (!resource.data.keys().hasAny(['handle']) && request.resource.data.handle == '') ||
          (resource.data.keys().hasAny(['handle']) &&
            request.resource.data.handle == resource.data.handle) ||
          ((!resource.data.keys().hasAny(['handle']) || resource.data.handle == '') &&
            request.resource.data.handle.matches('^[a-z0-9_-]{3,20}$') &&
            isHandleSystemReady() &&
            canClaimHandle(request.resource.data.handle) &&
            existsAfter(/databases/$(database)/documents/handles/$(request.resource.data.handle)) &&
            getAfter(/databases/$(database)/documents/handles/$(request.resource.data.handle)).data.uid == userId)
        ) &&
        (request.resource.data.handle == '' ||
          request.resource.data.displayName == request.resource.data.handle) &&
        request.resource.data.createdAt == resource.data.createdAt &&
        request.resource.data.updatedAt == request.time;
      allow delete: if false;

      // Notifications: user can read, mark read, and delete their own notifications.
      // Creation is reserved for server-side Cloud Functions.
      match /notifications/{notificationId} {
        allow read, update, delete: if isAuthenticated() && request.auth.uid == userId;
        allow create: if false;
      }

      // Warnings: user can read their own warnings; staff with canModerate() can review & create warnings.
      match /warnings/{warningId} {
        allow read: if (isAuthenticated() && request.auth.uid == userId) || canModerate();
        allow create, update, delete: if false;
      }
    }

    match /publicProfiles/{userId} {
      allow get: if true;
      allow list, create, update, delete: if false;
    }

    match /publicAuthors/{userId} {
      allow read: if true;
      allow create, update, delete: if false;
    }

    // Exact handles can be checked during authenticated onboarding, but the
    // collection cannot be enumerated.
    match /handles/{handle} {
      allow get: if isAuthenticated();
      allow list: if false;
      allow create: if isAuthenticated() &&
        isHandleSystemReady() &&
        handle.matches('^[a-z0-9_-]{3,20}$') &&
        canClaimHandle(handle) &&
        request.resource.data.keys().hasOnly(['uid', 'createdAt']) &&
        request.resource.data.uid == request.auth.uid &&
        request.resource.data.createdAt == request.time &&
        getAfter(/databases/$(database)/documents/users/$(request.auth.uid)).data.handle == handle;
      allow update: if false;
      allow delete: if false;
    }

    // Exact lookups provide a friendly onboarding message. Reservations are
    // created only by trusted server functions and cannot be enumerated.
    match /handleReservations/{reservationKey} {
      allow get: if isAuthenticated();
      allow list, create, update, delete: if false;
    }

    match /handleConfig/{configId} {
      allow get: if isAuthenticated() && configId == 'status';
      allow list, create, update, delete: if false;
    }

    // Comments are publicly readable when visible. Owners can edit their own
    // text, while CMS staff can hide, restore, or delete according to role hierarchy.
    match /comments/{commentId} {
      allow read: if (resource.data.status == 'visible' &&
          exists(/databases/$(database)/documents/articles/$(resource.data.articleId)) &&
          get(/databases/$(database)/documents/articles/$(resource.data.articleId)).data.publish == true) ||
        isStaff() ||
        (isAuthenticated() && resource.data.authorId == request.auth.uid);
      // Creation is rate-limited and identity-bound by createComment.
      allow create: if false;
      allow update: if (
        isAuthenticated() &&
        resource.data.authorId == request.auth.uid &&
        resource.data.status == 'visible' &&
        request.resource.data.diff(resource.data).affectedKeys().hasOnly([
          'content', 'updatedAt', 'edited'
        ]) &&
        request.resource.data.content is string &&
        request.resource.data.content.size() <= 2000 &&
        (request.resource.data.content.size() >= 1 || resource.data.keys().hasAny(['imageUrl', 'images'])) &&
        request.resource.data.updatedAt == request.time &&
        request.resource.data.edited == true
      ) || (
        (canModerate() || (isAuthenticated() && resource.data.authorId == request.auth.uid)) &&
        request.resource.data.diff(resource.data).affectedKeys().hasOnly([
          'status', 'moderatedAt', 'moderatedBy'
        ]) &&
        request.resource.data.status in ['visible', 'hidden'] &&
        request.resource.data.moderatedAt == request.time &&
        request.resource.data.moderatedBy == request.auth.uid
      );
      allow delete: if (isAuthenticated() && resource.data.authorId == request.auth.uid) ||
        isSuperAdmin() ||
        (isAdmin() && (!exists(/databases/$(database)/documents/authors/$(resource.data.authorId)) ||
          get(/databases/$(database)/documents/authors/$(resource.data.authorId)).data.role != 'super')) ||
        (isModerator() && (!exists(/databases/$(database)/documents/authors/$(resource.data.authorId)) ||
          get(/databases/$(database)/documents/authors/$(resource.data.authorId)).data.role in ['author']));
    }

    // One-level public replies. Owners control their own text; CMS staff
    // control visibility and deletion according to role hierarchy.
    match /commentReplies/{replyId} {
      allow read: if (resource.data.status == 'visible' &&
          exists(/databases/$(database)/documents/articles/$(resource.data.articleId)) &&
          get(/databases/$(database)/documents/articles/$(resource.data.articleId)).data.publish == true) ||
        isStaff() ||
        (isAuthenticated() && resource.data.authorId == request.auth.uid);
      // Creation is rate-limited and identity-bound by createCommentReply.
      allow create: if false;
      allow update: if (
        isAuthenticated() &&
        resource.data.authorId == request.auth.uid &&
        resource.data.status == 'visible' &&
        request.resource.data.diff(resource.data).affectedKeys().hasOnly([
          'content', 'updatedAt', 'edited'
        ]) &&
        request.resource.data.content is string &&
        request.resource.data.content.size() <= 2000 &&
        (request.resource.data.content.size() >= 1 || resource.data.keys().hasAny(['imageUrl', 'images'])) &&
        request.resource.data.updatedAt == request.time &&
        request.resource.data.edited == true
      ) || (
        (canModerate() || (isAuthenticated() && resource.data.authorId == request.auth.uid)) &&
        request.resource.data.diff(resource.data).affectedKeys().hasOnly([
          'status', 'moderatedAt', 'moderatedBy'
        ]) &&
        request.resource.data.status in ['visible', 'hidden'] &&
        request.resource.data.moderatedAt == request.time &&
        request.resource.data.moderatedBy == request.auth.uid
      );
      allow delete: if (isAuthenticated() && resource.data.authorId == request.auth.uid) ||
        isSuperAdmin() ||
        (isAdmin() && (!exists(/databases/$(database)/documents/authors/$(resource.data.authorId)) ||
          get(/databases/$(database)/documents/authors/$(resource.data.authorId)).data.role != 'super')) ||
        (isModerator() && (!exists(/databases/$(database)/documents/authors/$(resource.data.authorId)) ||
          get(/databases/$(database)/documents/authors/$(resource.data.authorId)).data.role in ['author']));
    }

    // Reactions are written by a trusted callable function so counts cannot be
    // forged. A signed-in user may only read their own reaction state.
    match /commentReactions/{userId}/items/{commentId} {
      allow read: if isAuthenticated() && request.auth.uid == userId;
      allow create, update, delete: if false;
    }

    // Assets are restricted to CMS users. Public account authentication must
    // never grant access to the content library.
    match /assets/{assetId} {
      allow read, write: if isCmsUser();
    }


    // Meta (Stats): Authenticated users can read
    match /meta/{docId} {
      allow read: if isCmsUser();
      allow write: if isAdmin();
    }

    // Asset Index: Authenticated users can read (for search/stats)
    match /assets_index/{docId} {
      allow read: if isCmsUser();
    }

    // Activity Audit Logs: Super Admins can read all logs. Client-created records are
    // immutable and their critical actor identity must match authenticated staff data.
    match /auditLogs/{logId} {
      allow read: if isSuperAdmin();
      allow create, update, delete: if false;
    }

    // User & Comment Reports: Any authenticated reader or staff can submit a report (cannot report self or team members).
    // Only Super Admins, Admins, and Moderators can read, review, and manage reports.
    match /reports/{reportId} {
      allow create: if false;
      allow read: if canModerate();
      allow update: if false;
      allow delete: if isSuperAdmin() || isAdmin();
    }

    // Network and browser-installation risk records are server-only.
    match /bannedIps/{ipId} {
      allow read, create, update, delete: if false;
    }

    match /bannedDevices/{deviceHash} {
      allow read, create, update, delete: if false;
    }

    match /bannedFingerprints/{fingerprintHash} {
      allow read, create, update, delete: if false;
    }

    match /deviceIdentityRegistry/{deviceHash} {
      allow read, create, update, delete: if false;
    }

    match /flaggedIps/{ipId} {
      allow read, create, update, delete: if false;
    }

    // Durable risk observations are written only by trusted Cloud Functions.
    // Moderators receive a private notification rather than direct access to
    // raw device, fingerprint, or network identifiers.
    match /riskAlerts/{alertId} {
      allow read, create, update, delete: if false;
    }

    match /rateLimits/{rateLimitId} {
      allow read, create, update, delete: if false;
    }

    match /riskAttestations/{userId} {
      allow read, create, update, delete: if false;
    }

    match /commentAttachmentClaims/{claimId} {
      allow read, create, update, delete: if false;
    }

    match /commentUploadReservations/{reservationId} {
      allow read, create, update, delete: if false;
    }
  }
}