firestore_simplified.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    
    // ============ CORE PRODUCT MANAGEMENT ============
    // Products - Enhanced rules for seller edit/delete functionality
    match /products/{productId} {
      // Anyone can read products (for browsing/shopping)
      allow read: if true;
      
      // Only authenticated artisans can create products with their own artisanId
      allow create: if request.auth != null && 
                   request.auth.uid == request.resource.data.artisanId;
      
      // Allow product owner updates OR likes/views updates by any authenticated user
      allow update: if request.auth != null && (
                   // Product owner can update everything
                   request.auth.uid == resource.data.artisanId ||
                   // Any authenticated user can update likes and views
                   request.resource.data.diff(resource.data).affectedKeys().hasOnly(['likes', 'likedBy', 'views'])
                   );
      
      // Only the product owner (artisan) can delete their products
      allow delete: if request.auth != null && 
                   request.auth.uid == resource.data.artisanId;
    }
    
    // ============ USER PROFILE MANAGEMENT ============
    // Sellers/Artisans - Enhanced profile management with dual account support
    match /sellers/{sellerId} {
      // Anyone can read seller profiles (for discovery)
      allow read: if true;
      
      // Allow creation/update if:
      // 1. Regular account: sellerId matches authenticated UID
      // 2. Dual account: sellerId starts with authenticated UID followed by '_retailer'
      allow create, update: if request.auth != null && 
                           (request.auth.uid == sellerId ||
                            sellerId == request.auth.uid + '_retailer');
      
      // Allow deletion with same logic as create/update
      allow delete: if request.auth != null && 
                   (request.auth.uid == sellerId ||
                    sellerId == request.auth.uid + '_retailer');
    }
    
    // Stores - Enhanced store management for sellers with dual account support
    match /stores/{storeId} {
      // Anyone can read store information
      allow read: if true;
      
      // Allow management if:
      // 1. Regular account: storeId matches authenticated UID
      // 2. Dual account: storeId starts with authenticated UID
      allow create, update, delete: if request.auth != null && 
                                   (request.auth.uid == storeId ||
                                    storeId == request.auth.uid + '_retailer');
    }
    
    // Customers - Customer profile management with dual account support
    match /customers/{customerId} {
      // Customers can read any customer profile (for social features)
      allow read: if request.auth != null;
      
      // Allow management if:
      // 1. Regular account: customerId matches authenticated UID
      // 2. Dual account: customerId starts with authenticated UID followed by '_customer'
      allow create, update, delete: if request.auth != null && 
                                   (request.auth.uid == customerId ||
                                    customerId == request.auth.uid + '_customer');
      
      // Customer subcollections (cart, favorites, etc.)
      match /{subcollection=**} {
        allow read, write: if request.auth != null && 
                          (request.auth.uid == customerId ||
                           customerId == request.auth.uid + '_customer');
      }
    }
    
    // Users - General user profiles and authentication data with dual account support
    match /users/{userId} {
      // Users can read any user profile (for social features and collaboration)
      allow read: if request.auth != null;
      
      // Allow management if:
      // 1. Regular account: userId matches authenticated UID
      // 2. Dual account: userId starts with authenticated UID
      allow create, update, delete: if request.auth != null && 
                                   (request.auth.uid == userId ||
                                    userId.matches(request.auth.uid + '_.*'));
      
      // User subcollections with dual account support
      match /{subcollection=**} {
        allow read, write: if request.auth != null && 
                          (request.auth.uid == userId ||
                           userId.matches(request.auth.uid + '_.*'));
      }
    }

    // ============ RETAILERS COLLECTION ============
    // Add specific collection for retailers with dual account support
    match /retailers/{retailerId} {
      // Anyone can read retailer profiles (for discovery)
      allow read: if true;
      
      // Allow creation/update if:
      // 1. Regular account: retailerId matches authenticated UID
      // 2. Dual account: retailerId starts with authenticated UID followed by '_retailer'
      allow create, update: if request.auth != null && 
                           (request.auth.uid == retailerId ||
                            retailerId == request.auth.uid + '_retailer');
      
      // Allow deletion with same logic as create/update
      allow delete: if request.auth != null && 
                   (request.auth.uid == retailerId ||
                    retailerId == request.auth.uid + '_retailer');
    }
    
    // ============ ORDER AND TRANSACTION MANAGEMENT ============
    // Orders - Simplified rules for order creation
    match /orders/{orderId} {
      // Anyone can read orders if they are a participant
      allow read: if request.auth != null && 
        (request.auth.uid == resource.data.buyerId || 
         request.auth.uid == resource.data.sellerId ||
         request.auth.uid == resource.data.artisanId);
      
      // Allow creation if user is the buyer with basic validation
      allow create: if request.auth != null && 
                   request.auth.uid == request.resource.data.buyerId &&
                   request.resource.data.buyerId is string &&
                   request.resource.data.totalAmount is number &&
                   request.resource.data.totalAmount > 0;
      
      // Allow updates by order participants
      allow update: if request.auth != null && 
        (request.auth.uid == resource.data.buyerId || 
         request.auth.uid == resource.data.sellerId ||
         request.auth.uid == resource.data.artisanId);
      
      // Allow deletion by buyer only
      allow delete: if request.auth != null && 
                   request.auth.uid == resource.data.buyerId;
    }
    
    // Daily Revenue - For seller analytics
    match /daily_revenue/{revenueId} {
      // Only the seller can read their own revenue data
      allow read, write: if request.auth != null && 
                        request.auth.uid == resource.data.sellerId;
      
      // Allow creation of revenue records
      allow create: if request.auth != null;
    }
    
    // ============ REVIEWS AND RATINGS ============
    match /reviews/{reviewId} {
      // Anyone can read reviews
      allow read: if true;
      
      // Only buyers can create reviews for their orders
      allow create: if request.auth != null && 
                   request.auth.uid == request.resource.data.buyerId;
      
      // Buyers can update their own reviews, sellers can respond
      allow update: if request.auth != null && 
                   (request.auth.uid == resource.data.buyerId ||
                    request.auth.uid == resource.data.sellerId);
      
      // Only review author can delete
      allow delete: if request.auth != null && 
                   request.auth.uid == resource.data.buyerId;
    }
    
    // ============ FAVORITES AND SOCIAL FEATURES ============
    match /favorites/{favoriteId} {
      // Users can only manage their own favorites
      allow read, write: if request.auth != null && 
                        request.auth.uid == resource.data.userId;
    }
    
    // User activity and engagement
    match /user_activity/{activityId} {
      allow read, write: if request.auth != null && 
                        request.auth.uid == resource.data.userId;
    }
    
    // ============ COMMUNICATION ============
    match /chat_rooms/{chatRoomId} {
      // Only chat participants can access
      allow read, write: if request.auth != null && 
        (request.auth.uid == resource.data.customerId || 
         request.auth.uid == resource.data.artisanId ||
         request.auth.uid == resource.data.sellerId);
      
      // Messages within chat rooms
      match /messages/{messageId} {
        allow read, write: if request.auth != null;
      }
    }
    
    // Conversations - Enhanced messaging
    match /conversations/{conversationId} {
      allow read, write: if request.auth != null && 
                        request.auth.uid in resource.data.participants;
      
      match /messages/{messageId} {
        allow read, write: if request.auth != null;
      }
    }
    
    // ============ NOTIFICATIONS ============
    // Notifications - Enhanced rules for notification system
    match /notifications/{notificationId} {
      // Users can only read their own notifications
      allow read: if request.auth != null && 
                 request.auth.uid == resource.data.userId;
      
      // Allow creating notifications for any user by authenticated users
      // This allows the order service to create notifications for artisans
      allow create: if request.auth != null;
      
      // Users can update/delete their own notifications
      allow update, delete: if request.auth != null && 
                           request.auth.uid == resource.data.userId;
    }
    
    // Push notification requests - for FCM integration
    match /push_notification_requests/{requestId} {
      allow create: if request.auth != null;
      allow read, update, delete: if request.auth != null;
    }
    
    // ============ CRAFT REQUESTS ============
    match /craft_requests/{requestId} {
      // Anyone can read requests (for discovery/browsing)
      allow read: if true;
      
      // Only authenticated users can create requests
      allow create: if request.auth != null && 
                   request.auth.uid == request.resource.data.buyerId;
      
      // Buyers can update their own requests
      // Any authenticated user can update to add quotations (app logic handles validation)
      allow update: if request.auth != null;
      
      // Buyers can delete their own requests
      allow delete: if request.auth != null && 
                   request.auth.uid == resource.data.buyerId;
    }

    // ============ ADMINISTRATIVE AND SYSTEM ============
    match /categories/{categoryId} {
      allow read: if true;
      allow write: if false; // Admin/system only
    }
    
    // Analytics - System-level analytics
    match /analytics/{analyticsId} {
      allow read: if request.auth != null;
      allow write: if false; // System only
    }
    
    // Promotions and marketing
    match /promotions/{promotionId} {
      allow read: if true;
      allow write: if false; // Admin only
    }
    
    // System configuration
    match /system_config/{configId} {
      allow read: if request.auth != null;
      allow write: if false; // Admin only
    }
    
    // ============ LIVING WORKSHOPS ============
    match /living_workshops/{workshopId} {
      // Anyone can read workshops for public viewing experiences
      allow read: if true;
      
      // Only authenticated users can create workshops with their own userId
      allow create: if request.auth != null && 
                   (request.auth.uid == workshopId || 
                    request.auth.uid == request.resource.data.userId ||
                    request.auth.uid == request.resource.data.artisanId);
      
      // Only the workshop owner can update their workshop
      allow update: if request.auth != null && 
                   (request.auth.uid == workshopId ||
                    request.auth.uid == resource.data.userId ||
                    request.auth.uid == resource.data.artisanId);
      
      // Only the workshop owner can delete their workshop
      allow delete: if request.auth != null && 
                   (request.auth.uid == workshopId ||
                    request.auth.uid == resource.data.userId ||
                    request.auth.uid == resource.data.artisanId);
    }
    
    // ============ FALLBACK RULES ============
    // General authenticated access for other collections
    match /{document=**} {
      allow read: if request.auth != null;
      allow write: if false; // Explicit permissions required
    }
  }
}