firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    
    // ============================================
    // FUNÇÕES AUXILIARES DE SEGURANÇA E VALIDAÇÃO
    // ============================================
    
    function isAuthenticated() {
      return request.auth != null;
    }
    
    function isOwner(userId) {
      return isAuthenticated() && request.auth.uid == userId;
    }
    
    function isAdmin() {
      return isAuthenticated() &&
             request.auth.token.email == 'albertoivo@gmail.com' &&
             request.auth.token.email_verified == true;
    }

    function isOwnerOrAdmin(userId) {
      return isOwner(userId) || isAdmin();
    }

    function hasOnly(data, fields) {
      return data.keys().toSet().hasOnly(fields);
    }

    function isValidString(val, maxLen) {
      return val is string && val.size() <= maxLen;
    }

    function isValidNumber(val, minVal, maxVal) {
      return val is number && val >= minVal && val <= maxVal;
    }

    // ============================================
    // 1. QUESTÕES (Read: Público | Write: Admin)
    // ============================================
    match /questions/{questionId} {
      allow read: if true;
      allow write: if isAdmin();
    }
    
    // ============================================
    // 2. USUÁRIOS (Read/Write: Dono ou Admin + Schema)
    // ============================================
    match /users/{userId} {
      allow read: if isOwnerOrAdmin(userId);
      
      allow create, update: if isOwnerOrAdmin(userId) &&
        hasOnly(request.resource.data, [
          'uid', 'displayName', 'avatar', 'email', 
          'createdAt', 'updatedAt', 'totalScore', 
          'balance', 'unlockedWorlds', 'lastLoginAt'
        ]) &&
        (!('displayName' in request.resource.data) || isValidString(request.resource.data.displayName, 50)) &&
        (!('avatar' in request.resource.data) || isValidString(request.resource.data.avatar, 500)) &&
        (!('email' in request.resource.data) || (isValidString(request.resource.data.email, 100) && request.resource.data.email.matches('.*@.*'))) &&
        (!('createdAt' in request.resource.data) || request.resource.data.createdAt is timestamp) &&
        (!('updatedAt' in request.resource.data) || request.resource.data.updatedAt is timestamp) &&
        (!('lastLoginAt' in request.resource.data) || request.resource.data.lastLoginAt is timestamp) &&
        (!('totalScore' in request.resource.data) || isValidNumber(request.resource.data.totalScore, 0, 9999999)) &&
        (!('balance' in request.resource.data) || isValidNumber(request.resource.data.balance, 0, 9999999)) &&
        (!('unlockedWorlds' in request.resource.data) || (request.resource.data.unlockedWorlds is list && request.resource.data.unlockedWorlds.size() <= 1000));
    }

    // ============================================
    // 3. GAMIFICAÇÃO (Read/Write: Dono ou Admin)
    // ============================================
    match /gamification/{userId} {
      allow read: if isOwnerOrAdmin(userId);
      
      allow write: if isOwnerOrAdmin(userId) &&
        ('level' in request.resource.data) &&
        ('streak' in request.resource.data) &&
        ('achievements' in request.resource.data) &&
        ('activeMissions' in request.resource.data) &&
        ('stats' in request.resource.data) &&
        (!('updatedAt' in request.resource.data) || request.resource.data.updatedAt is timestamp);
    }
    
    // ============================================
    // 4. PROGRESSO DO USUÁRIO (Format: uid_questionId)
    // ============================================
    match /userProgress/{progressId} {
      function getProgressUid(pId) {
        return pId.split('_')[0];
      }
      
      allow read: if isAuthenticated() && (
        getProgressUid(progressId) == request.auth.uid ||
        (resource != null && resource.data.uid == request.auth.uid) ||
        isAdmin()
      );
      
      allow write: if isAuthenticated() && (
        (getProgressUid(progressId) == request.auth.uid &&
         request.resource.data.uid == request.auth.uid &&
         hasOnly(request.resource.data, [
           'uid', 'questionId', 'status', 'score', 'stars', 
           'attempts', 'bestTimeSeconds', 'lastAttemptAt', 'userAnswer'
         ]) &&
         (!('status' in request.resource.data) || request.resource.data.status in ['not_started', 'in_progress', 'completed']) &&
         (!('score' in request.resource.data) || isValidNumber(request.resource.data.score, 0, 9999)) &&
         (!('attempts' in request.resource.data) || isValidNumber(request.resource.data.attempts, 0, 9999)) &&
         (!('stars' in request.resource.data) || isValidNumber(request.resource.data.stars, 0, 3)) &&
         (!('bestTimeSeconds' in request.resource.data) || isValidNumber(request.resource.data.bestTimeSeconds, 0, 99999))
        ) ||
        isAdmin()
      );
    }

    // ============================================
    // 5. LEADERBOARD (Read: Autenticado | Write: Dono/Admin)
    // ============================================
    match /leaderboard/{userId} {
      allow read: if isAuthenticated();
      
      allow write: if isOwnerOrAdmin(userId) &&
        hasOnly(request.resource.data, ['uid', 'displayName', 'avatar', 'totalScore', 'level', 'updatedAt']) &&
        (!('displayName' in request.resource.data) || isValidString(request.resource.data.displayName, 50)) &&
        (!('avatar' in request.resource.data) || isValidString(request.resource.data.avatar, 500)) &&
        (!('updatedAt' in request.resource.data) || request.resource.data.updatedAt is timestamp) &&
        (!('totalScore' in request.resource.data) || isValidNumber(request.resource.data.totalScore, 0, 9999999)) &&
        (!('level' in request.resource.data) || isValidNumber(request.resource.data.level, 0, 1000));
    }
  }
}