firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {

    // --- HELPERS ---

    function isAuthenticated() {
      return request.auth != null;
    }

    function getUserData() {
      return get(/databases/$(database)/documents/users/$(request.auth.uid)).data;
    }

    function hasRole(role) {
      return isAuthenticated() && getUserData().role == role;
    }

    function hasAnyRole(roles) {
      return isAuthenticated() && getUserData().role in roles;
    }

    function isOwner(uid) {
      return isAuthenticated() && request.auth.uid == uid;
    }

    function isSameRegion(resourceData) {
      return resourceData.region == getUserData().region;
    }

    function assignmentDocId(taskId, volunteerId) {
      return taskId + '_' + volunteerId;
    }

    function hasAcceptedAssignment(taskId) {
      return isAuthenticated() &&
        exists(/databases/$(database)/documents/taskAssignments/$(assignmentDocId(taskId, request.auth.uid))) &&
        get(/databases/$(database)/documents/taskAssignments/$(assignmentDocId(taskId, request.auth.uid))).data.status == 'accepted';
    }

    // --- COLLECTIONS ---

    // Users Collection (Auth & Profiles)
    match /users/{uid} {
      allow read: if isAuthenticated() && (
        isOwner(uid) ||
        hasAnyRole(['ngo_founder', 'ngo_admin', 'super_admin']) ||
        (hasRole('field_lead') && isSameRegion(resource.data))
      );
      allow create: if isAuthenticated() && isOwner(uid);
      allow update: if isAuthenticated() && (
        isOwner(uid) ||
        hasAnyRole(['ngo_founder', 'ngo_admin', 'super_admin'])
      );
      allow delete: if hasRole('super_admin');
    }

    // Volunteers Collection (Verified Profiles)
    match /volunteers/{volId} {
      allow read: if isAuthenticated() && (
        hasAnyRole(['volunteer', 'field_lead', 'ngo_founder', 'ngo_admin', 'super_admin'])
      );
      allow create: if hasAnyRole(['ngo_founder', 'ngo_admin', 'super_admin']);
      allow update: if isAuthenticated() && (
        isOwner(volId) ||
        hasAnyRole(['ngo_founder', 'ngo_admin', 'super_admin'])
      );
      allow delete: if hasRole('super_admin');
    }

    // Needs Collection (Crisis Reports)
    match /needs/{needId} {
      // All authenticated users can read needs (applicants see the live map during onboarding)
      allow read: if isAuthenticated();
      allow create: if isAuthenticated() && (
        hasAnyRole(['volunteer', 'field_lead', 'ngo_founder', 'ngo_admin', 'super_admin'])
      );
      allow update: if isAuthenticated() && (
        hasAnyRole(['ngo_founder', 'ngo_admin', 'super_admin']) ||
        (hasRole('field_lead') && isSameRegion(resource.data))
      );
      allow delete: if hasRole('super_admin');
    }

    // Tasks Collection (Assigned Operations)
    match /tasks/{taskId} {
      allow read: if isAuthenticated() && (
        hasAnyRole(['volunteer', 'field_lead', 'ngo_founder', 'ngo_admin', 'super_admin']) ||
        (request.auth.uid in resource.data.volunteerIds)
      );
      allow create: if hasAnyRole(['ngo_founder', 'ngo_admin', 'super_admin', 'field_lead']);
      allow update: if isAuthenticated() && (
        hasAnyRole(['ngo_founder', 'ngo_admin', 'super_admin']) ||
        (hasRole('field_lead') && isSameRegion(resource.data)) ||
        (request.auth.uid in resource.data.volunteerIds) ||
        hasAcceptedAssignment(taskId)
      );
      allow delete: if hasAnyRole(['ngo_founder', 'ngo_admin', 'super_admin']);
    }

    // Task Assignments (Volunteer requests)
    match /taskAssignments/{assignmentId} {
      allow read: if isAuthenticated() && (
        hasAnyRole(['ngo_founder', 'ngo_admin', 'super_admin']) ||
        (hasRole('field_lead') && isSameRegion(resource.data)) ||
        (resource.data.volunteerId == request.auth.uid)
      );

      allow create: if isAuthenticated() && (
        hasAnyRole(['ngo_founder', 'ngo_admin', 'super_admin']) ||
        (hasRole('field_lead') && request.resource.data.region == getUserData().region)
      )
      && request.resource.data.requestedBy == request.auth.uid
      && request.resource.data.status == 'pending';

      allow update: if isAuthenticated() && (
        // volunteer response
        (
          resource.data.volunteerId == request.auth.uid &&
          resource.data.status == 'pending' &&
          request.resource.data.status in ['accepted', 'declined']
        )
        ||
        // coordinator/admin cancel
        (
          (hasAnyRole(['ngo_founder', 'ngo_admin', 'super_admin']) || (hasRole('field_lead') && isSameRegion(resource.data))) &&
          resource.data.status == 'pending' &&
          request.resource.data.status == 'cancelled'
        )
      );

      allow delete: if false;
    }

    // Task Contacts (contact unlocked only after acceptance)
    match /taskContacts/{taskId} {
      allow read: if isAuthenticated() && (
        hasAnyRole(['ngo_founder', 'ngo_admin', 'super_admin']) ||
        (hasRole('field_lead') && isSameRegion(resource.data)) ||
        hasAcceptedAssignment(taskId)
      );

      allow create, update: if isAuthenticated() && (
        hasAnyRole(['ngo_founder', 'ngo_admin', 'super_admin']) ||
        (hasRole('field_lead') && request.resource.data.region == getUserData().region)
      ) && request.resource.data.createdBy == request.auth.uid;

      allow delete: if hasRole('super_admin');
    }

    // Activities Collection (Audit Log)
    match /activities/{activityId} {
      // All authenticated users can read activities (feeds home & insights screens)
      allow read: if isAuthenticated();
      allow create: if isAuthenticated();
      allow update, delete: if false; // Immutable audit log
    }

    // Inventory Collection (Resources)
    match /inventory/{itemId} {
      allow read: if isAuthenticated() && hasAnyRole(['ngo_founder', 'ngo_admin', 'super_admin', 'field_lead', 'volunteer']);
      allow create, update: if hasAnyRole(['ngo_founder', 'ngo_admin', 'super_admin']);
      allow delete: if hasRole('super_admin');
    }

    // Inventory Transactions (Movement Ledger)
    match /inventory_transactions/{txId} {
      allow read: if isAuthenticated() && hasAnyRole(['ngo_founder', 'ngo_admin', 'super_admin', 'field_lead']);
      allow create: if isAuthenticated() && hasAnyRole(['ngo_founder', 'ngo_admin', 'super_admin', 'field_lead']);
      allow update, delete: if false; // Immutable transaction log
    }

    // NGO Registry (Organization Profiles)
    match /ngos/{ngoId} {
      allow read: if isAuthenticated();
      allow create: if isAuthenticated() && (
        hasAnyRole(['ngo_founder', 'ngo_admin', 'super_admin']) &&
        request.resource.data.founderId == request.auth.uid
      );
      allow update: if isAuthenticated() && (
        hasRole('super_admin') ||
        (hasAnyRole(['ngo_founder', 'ngo_admin']) && request.auth.uid in resource.data.memberIds)
      );
      allow delete: if hasRole('super_admin');
    }

    // NGO Memberships (Org-User Relationships)
    match /ngo_memberships/{membershipId} {
      allow read: if isAuthenticated() && (
        hasAnyRole(['ngo_founder', 'ngo_admin', 'super_admin']) ||
        resource.data.userId == request.auth.uid
      );
      allow create: if hasAnyRole(['ngo_founder', 'ngo_admin', 'super_admin']);
      allow update: if hasAnyRole(['ngo_founder', 'ngo_admin', 'super_admin']);
      allow delete: if hasRole('super_admin');
    }

    // Notification Preferences (User-Private Settings)
    match /notification_preferences/{uid} {
      allow read, write: if isAuthenticated() && isOwner(uid);
    }
  }
}