firestore.rules

rules_version = '2';

service cloud.firestore {
  match /databases/{database}/documents {

    // --- Helper Functions ---
    function isValidUsername(username) {
      // Username must be a string between 1 and 100 characters
      // and must not contain characters that can be used for XSS.
      return username is string &&
             username.size() > 0 &&
             username.size() <= 100 &&
             !username.matches(".*[<>&'\"].*") &&
             !username.toLower().matches(".*ukiyo.*") &&
             !username.toLower().matches(".*rekindle.*");
    }

    function isValidText(text) {
      // A basic check for message content to prevent HTML injection.
      return text is string &&
             text.size() > 0 &&
             text.size() <= 1000 && // Limit message length
             !text.matches('.*[<>].*'); // Block basic HTML tags
    }

    // --- Collection Rules ---

    function isDeveloper() {
      return request.auth != null && (
        request.auth.uid == 'ukiyo' ||
        request.auth.token.email == 'ukiyo@rekindle.ink'
      );
    }

    // Helper to check if user is Pro
    function isProUser() {
      let uid = request.auth.uid;
      let email = request.auth.token.email;
      
      // 1. Check legacy proExpiresAt on user document
      let userDoc = get(/databases/$(database)/documents/users/$(uid));
      let hasLegacyPro = userDoc != null && 
             'proExpiresAt' in userDoc.data && 
             userDoc.data.proExpiresAt != null &&
             userDoc.data.proExpiresAt > request.time;
             
      // 2. Check /config/supporters document (the new source of truth)
      // Note: We check by email as it's the most reliable backend identifier.
      let supportersDoc = get(/databases/$(database)/documents/config/supporters);
      let isSupporter = supportersDoc != null && 
                        email != null && 
                        email in supportersDoc.data && 
                        supportersDoc.data[email].expiresAt != null &&
                        supportersDoc.data[email].expiresAt > request.time;
      
      return isDeveloper() || hasLegacyPro || isSupporter;
    }

    // 1. USER PRIVATE DATA (e.g., settings, notes, substack_sid)
    match /users/{userId} {
      allow read: if request.auth != null && (request.auth.uid == userId || isDeveloper());
      
      // Allow create, but strictly BLOCK setting 'isPro', 'proExpiresAt', or 'substack_sid' during creation.
      allow create: if request.auth != null && 
                       request.auth.uid == userId &&
                       !request.resource.data.keys().hasAny(['isPro', 'proExpiresAt', 'substack_sid']);
      
      // Allow update, but:
      // - BLOCK modifying 'isPro' or 'proExpiresAt' (unless admin)
      // - BLOCK modifying 'substack_sid' unless user is Pro
      allow update: if request.auth != null && (
                      // Admin can update anything
                      isDeveloper()
                      ||
                      // Regular user update rules
                      (request.auth.uid == userId && 
                       !request.resource.data.diff(resource.data).affectedKeys().hasAny(['isPro', 'proExpiresAt']) &&
                       // If changing substack_sid, must be Pro
                       (!request.resource.data.diff(resource.data).affectedKeys().hasAny(['substack_sid']) || isProUser())
                      )
                    );

      allow delete: if request.auth != null && request.auth.uid == userId;

      // PRO-ONLY SUBCOLLECTION: Contains sensitive data only Pro users can access
      match /pro_data/{docId} {
        allow read, write: if request.auth != null && 
                              request.auth.uid == userId && 
                              isProUser();
      }

      // Other known subcollections (general access for authenticated owner)
      // NOTE: pro_data is handled above with stricter rules
      match /settings/{docId} {
        allow read, write: if request.auth != null && request.auth.uid == userId;
      }
      match /tasks/{docId} {
        allow read, write: if request.auth != null && request.auth.uid == userId;
      }
      match /notes/{docId} {
        allow read, write: if request.auth != null && request.auth.uid == userId;
      }

      // NEWLY ADDED SUBCOLLECTIONS FOR VARIOUS APPS
      match /library/{docId} {
        allow read, write: if request.auth != null && request.auth.uid == userId;
      }
      match /rss_feeds/{docId} {
        allow read, write: if request.auth != null && request.auth.uid == userId;
      }
      match /apps/{docId} {
        allow read, write: if request.auth != null && request.auth.uid == userId;
      }
      match /chords/{docId} {
        allow read, write: if request.auth != null && request.auth.uid == userId;
      }
      match /contacts/{docId} {
        allow read, write: if request.auth != null && request.auth.uid == userId;
      }
      match /cookbook/{docId} {
        allow read, write: if request.auth != null && request.auth.uid == userId;
      }
      match /countdown_events/{docId} {
        allow read, write: if request.auth != null && request.auth.uid == userId;
      }
      match /events/{docId} {
        allow read, write: if request.auth != null && request.auth.uid == userId;
      }
      match /flashcard_decks/{docId} {
        allow read, write: if request.auth != null && request.auth.uid == userId;
      }
      match /flashcards/{docId} {
        allow read, write: if request.auth != null && request.auth.uid == userId;
      }
      match /flipnote_animations/{docId} {
        allow read, write: if request.auth != null && request.auth.uid == userId;
      }
      match /habit_history/{docId} {
        allow read, write: if request.auth != null && request.auth.uid == userId;
      }
      match /habits/{docId} {
        allow read, write: if request.auth != null && request.auth.uid == userId;
      }
      match /interactive_games/{docId} {
        allow read, write: if request.auth != null && request.auth.uid == userId;
      }
      match /mindmaps/{docId} {
        allow read, write: if request.auth != null && request.auth.uid == userId;
      }
      match /pixel_drawings/{docId} {
        allow read, write: if request.auth != null && request.auth.uid == userId;
      }
      match /privateSettings/{docId} {
        allow read, write: if request.auth != null && request.auth.uid == userId;
      }
      match /reading_list/{docId} {
        allow read, write: if request.auth != null && request.auth.uid == userId;
      }
      match /reading_logs/{docId} {
        allow read, write: if request.auth != null && request.auth.uid == userId;
      }
      match /sheet_music_library/{docId} {
        allow read, write: if request.auth != null && request.auth.uid == userId;
      }
      match /watchlist/{docId} {
        allow read, write: if request.auth != null && request.auth.uid == userId;
      }
      match /chatLimits/{docId} {
        allow read, write: if request.auth != null && request.auth.uid == userId;
      }
      match /topic_states/{topicId} {
        allow read, write: if request.auth != null && request.auth.uid == userId;
      }
    }

    // --- NEIGHBOURHOOD APP ---
    match /users_public/{userId} {
      allow read: if request.auth != null;
      allow write: if request.auth != null && request.auth.uid == userId;
    }

    // --- TOPICS APP ---
    match /topics/{topicId} {
      allow read: if request.auth != null;
      allow create: if request.auth != null && 
                       request.resource.data.authorId == request.auth.uid &&
                       isValidText(request.resource.data.title);
      // Allow update if author (to edit) or ANY user (to increment commentCount via transaction)
      allow update: if request.auth != null && (
        (resource.data.authorId == request.auth.uid) ||
        (request.resource.data.diff(resource.data).affectedKeys().hasOnly(['commentCount', 'lastActive']))
      );
      allow delete: if request.auth != null && (resource.data.authorId == request.auth.uid || isDeveloper());
    }

    match /topic_comments/{topicId} {
      allow read: if request.auth != null;
      match /{commentId} {
        allow read: if request.auth != null;
        allow create: if request.auth != null && 
                         request.resource.data.authorId == request.auth.uid &&
                         isValidText(request.resource.data.body);
        allow delete: if request.auth != null && (resource.data.authorId == request.auth.uid || isDeveloper());
      }
    }

    // 2. KINDLECHAT
    match /rooms/{roomId} {
      allow read: if request.auth != null;

      match /messages/{messageId} {
        allow read: if request.auth != null;
        // Secure create: Validate username and message text for safety.
        // Note: For anonymous users, email might be null, so check before accessing.
        allow create: if request.auth != null &&
                        (request.auth.token.email == null || request.resource.data.user == request.auth.token.email.split('@')[0]) &&
                        isValidText(request.resource.data.text);
        allow update: if request.auth != null && 
                         request.resource.data.diff(resource.data).affectedKeys().hasOnly(['reactions']);
        allow delete: if false;
      }
      
      // Allow creating and updating rooms (needed for DMs)
      allow create, update: if request.auth != null;
    }

    // 3. TETRIS LEADERBOARD
    match /leaderboard_tetris/{userId} {
      allow read: if request.auth != null;
      allow write: if request.auth != null &&
                      request.auth.uid == userId &&
                      isValidUsername(request.resource.data.username) &&
                      request.resource.data.score is number;
    }

    // 4. SNAKE LEADERBOARD
    match /leaderboard_snake/{userId} {
      allow read: if request.auth != null;
      allow write: if request.auth != null &&
                      request.auth.uid == userId &&
                      isValidUsername(request.resource.data.username) &&
                      request.resource.data.score is number;
    }

    // 4.5 DINO LEADERBOARD
    match /leaderboard_dino_v1/{userId} {
      allow read: if request.auth != null;
      allow write: if request.auth != null && request.auth.uid == userId;
      // Allow user to reset their score (delete document)
      allow delete: if request.auth != null && request.auth.uid == userId;
    }

    // 5. WORDS (Multiplayer Game)
    match /word_games/{gameId} {
      allow read: if request.auth != null;
      allow write: if request.auth != null &&
                      (request.resource.data.p1_uid == request.auth.uid ||
                       request.resource.data.p2_uid == request.auth.uid) &&
                      isValidUsername(request.resource.data.p1_name) &&
                      (request.resource.data.p2_name == null || isValidUsername(request.resource.data.p2_name));
    }

    // 6. FREEWRITE (Public Signaling for AirType)
    match /freewrite_sessions/{sessionId} {
      allow read, write: if true;
    }

    // 7. HANOI LEADERBOARD
    match /leaderboard_hanoi_3/{userId} {
      allow read: if request.auth != null;
      allow write: if request.auth != null && request.auth.uid == userId && isValidUsername(request.resource.data.username) && request.resource.data.moves is number;
    }
    match /leaderboard_hanoi_4/{userId} {
      allow read: if request.auth != null;
      allow write: if request.auth != null && request.auth.uid == userId && isValidUsername(request.resource.data.username) && request.resource.data.moves is number;
    }
    match /leaderboard_hanoi_5/{userId} {
      allow read: if request.auth != null;
      allow write: if request.auth != null && request.auth.uid == userId && isValidUsername(request.resource.data.username) && request.resource.data.moves is number;
    }
    match /leaderboard_hanoi_6/{userId} {
      allow read: if request.auth != null;
      allow write: if request.auth != null && request.auth.uid == userId && isValidUsername(request.resource.data.username) && request.resource.data.moves is number;
    }
    match /leaderboard_hanoi_7/{userId} {
      allow read: if request.auth != null;
      allow write: if request.auth != null && request.auth.uid == userId && isValidUsername(request.resource.data.username) && request.resource.data.moves is number;
    }

    // 8. LIGHTS OUT LEADERBOARD
    match /leaderboard_lightsout_3/{userId} {
      allow read: if request.auth != null;
      allow write: if request.auth != null && request.auth.uid == userId && isValidUsername(request.resource.data.username) && request.resource.data.moves is number;
    }
    match /leaderboard_lightsout_4/{userId} {
      allow read: if request.auth != null;
      allow write: if request.auth != null && request.auth.uid == userId && isValidUsername(request.resource.data.username) && request.resource.data.moves is number;
    }
    match /leaderboard_lightsout_5/{userId} {
      allow read: if request.auth != null;
      allow write: if request.auth != null && request.auth.uid == userId && isValidUsername(request.resource.data.username) && request.resource.data.moves is number;
    }

    // 9. TRIVIA LEADERBOARD
    match /leaderboard_trivia/{userId} {
      allow read: if request.auth != null;
      allow write: if request.auth != null &&
                      request.auth.uid == userId &&
                      isValidUsername(request.resource.data.username) &&
                      request.resource.data.totalPercent is number &&
                      request.resource.data.gameCount is number;
    }

    // 10. SOLITAIRE LEADERBOARD
    match /leaderboard_solitaire/{userId} {
      allow read: if request.auth != null;
      allow write: if request.auth != null &&
                      request.auth.uid == userId &&
                      isValidUsername(request.resource.data.username) &&
                      request.resource.data.moves is number;
    }

    // 10.5 BLOCK BLAST LEADERBOARD
    match /leaderboard_blockblast/{userId} {
      allow read: if request.auth != null;
      allow create: if request.auth != null && request.auth.uid == userId;
      allow update: if request.auth != null && request.auth.uid == userId 
                      && request.resource.data.score > resource.data.score;
      allow delete: if request.auth != null && request.auth.uid == userId;
    }

    // 10.6 PET LEADERBOARD
    match /leaderboard_pet_v1/{userId} {
      allow read: if request.auth != null;
      allow create: if request.auth != null && request.auth.uid == userId;
      allow update: if request.auth != null && request.auth.uid == userId 
                      && request.resource.data.score > resource.data.score;
      allow delete: if request.auth != null && request.auth.uid == userId;
    }

    // 10.7 MARIO LEADERBOARD
    match /leaderboard_mario/{userId} {
      allow read: if request.auth != null;
      allow write: if request.auth != null && request.auth.uid == userId;
    }

    // 11. INTERACTIVE BLACKLIST
    match /interactive_blacklist/{gameId} {
      allow read: if true;
      allow write: if request.auth != null;
    }

    // 11.5 CONFIG (Supporters)
    match /config/supporters {
      allow read: if request.auth != null;
      allow write: if isDeveloper();
    }

    // 12. USER UPLOADS
    match /interactive_uploads/{uploadId} {
      allow read: if true;
      allow create: if request.auth != null &&
                      request.resource.data.uploaderUid == request.auth.uid &&
                      isValidText(request.resource.data.title);
      allow delete: if request.auth != null && resource.data.uploaderUid == request.auth.uid;
    }

    // 13. SHEET MUSIC UPLOADS
    match /sheet_music_uploads/{uploadId} {
      allow read: if true;
      allow create: if request.auth != null &&
                      request.resource.data.uploaderUid == request.auth.uid &&
                      isValidText(request.resource.data.title);
      allow delete: if request.auth != null && resource.data.uploaderUid == request.auth.uid;
    }

    // 14. SUGGESTIONS APP
    match /suggestions/{suggestionId} {
      allow read: if true;
      allow create: if request.auth != null &&
                      isValidText(request.resource.data.title) &&
                      isValidText(request.resource.data.description) &&
                      (request.resource.data.category == null || isValidText(request.resource.data.category)) &&
                      (request.resource.data.device == null || isValidText(request.resource.data.device));
      
      // Update: 
      // 1. Author can edit their own suggestion (title/desc).
      // 2. ANY authenticated user can update 'upvotes' (toggle their UID in the array).
      // 3. Admin (ukiyo) can update any field for merging/moderation.
      allow update: if request.auth != null && (
          (resource.data.authorUid == request.auth.uid && 
           request.resource.data.diff(resource.data).affectedKeys().hasOnly(['title', 'description'])) 
          ||
          (request.resource.data.diff(resource.data).affectedKeys().hasOnly(['upvotes']))
          ||
          isDeveloper()
      );

      // Delete: Admin only (for merging duplicates)
      allow delete: if isDeveloper();

      match /comments/{commentId} {
        allow read: if true;
        allow create: if request.auth != null && isValidText(request.resource.data.text);
        allow delete: if request.auth != null && (resource.data.authorUid == request.auth.uid || isDeveloper());
      }
    }
  }
}