firestore.rules

rules_version = '2';
service cloud.firestore {

  // Get the current user's document
  function getCurrentUser() {
    return get(/databases/$(database)/documents/users/$(request.auth.uid));
  }

  // Get the current user's role, supporting both read and write operations
  function getUserRole() {
    // For writes that include a role field, use the new role being written
    return request.resource != null && request.resource.data.role is string
      ? request.resource.data.role
      : request.auth != null && exists(/databases/$(database)/documents/users/$(request.auth.uid)) 
        ? get(/databases/$(database)/documents/users/$(request.auth.uid)).data.role 
        : null;
  }

  // Check if a given role is super admin
  function hasSuperAdminRole(role) {
    return role == 'super_admin';
  }

  // Check if a given role is admin or super admin
  function hasAdminRole(role) {
    return ['admin', 'super_admin'].hasAny([role]);
  }

  // Check if a given role is agent, admin, or super admin
  function hasAgentRole(role) {
    return ['agent', 'admin', 'super_admin'].hasAny([role]);
  }

  // Check if current user is super admin
  function isSuperAdmin() {
    return hasSuperAdminRole(getUserRole());
  }

  // Check if current user is admin or super admin
  function isAdmin() {
    return hasAdminRole(getUserRole());
  }

  // Check if current user is agent, admin, or super admin
  function isAgent() {
    return hasAgentRole(getUserRole());
  }

  // Validate role transitions when updating user roles
  function isValidRoleTransition(oldRole, newRole) {
    // No role change is always valid
    return oldRole == newRole || (
      // Only super admins can assign super_admin role
      (newRole == 'super_admin' && hasSuperAdminRole(getUserRole())) ||
      // Only admins and super admins can assign admin role
      (newRole == 'admin' && hasAdminRole(getUserRole())) ||
      // Only admins and super admins can assign agent role
      (newRole == 'agent' && hasAdminRole(getUserRole())) ||
      // Only super admins can modify other super admins
      (oldRole == 'super_admin' && hasSuperAdminRole(getUserRole())) ||
      // Only admins and super admins can modify other admins
      (oldRole == 'admin' && hasAdminRole(getUserRole()))
    );
  }
  
  // Check if user has admin or agent privileges
  function isAdminOrAgent() {
    return isAdmin() || isAgent();
  }
  
  function isAuthenticated() {
    return request.auth != null;
  }
  
  function isOwner(userId) {
    return request.auth != null && request.auth.uid == userId;
  }
  
  // Validate order update fields
  function isValidOrderUpdate() {
    // Only allow specific fields to be updated
    let allowedFields = ['status', 'deliveryNotes', 'deliveryDate'];
    let isValid = request.resource.data.diff(resource.data).affectedKeys().hasOnly(allowedFields);
    
    // Status transition validation
    let statusValid = request.resource.data.status is string && resource.data.status is string
      ? (
          // Define valid statuses inline
          ['pending', 'processing', 'shipped', 'delivered', 'cancelled'].hasAny([request.resource.data.status]) &&
          // Status transition rules
          (
            // Can always stay in same status
            request.resource.data.status == resource.data.status ||
            // Can move from pending to processing
            (resource.data.status == 'pending' && request.resource.data.status == 'processing') ||
            // Can move from processing to shipped
            (resource.data.status == 'processing' && request.resource.data.status == 'shipped') ||
            // Can move from shipped to delivered
            (resource.data.status == 'shipped' && request.resource.data.status == 'delivered') ||
            // Can cancel from any state except delivered
            (resource.data.status != 'delivered' && request.resource.data.status == 'cancelled')
          )
        )
      : true; // If no status change, consider it valid
    
    // Delivery date validation
    let dateValid = request.resource.data.deliveryDate is timestamp
      ? request.resource.data.deliveryDate >= request.time
      : true; // If no date change, consider it valid
    
    return isValid && statusValid && dateValid;
  }
  
  // Validate user profile updates
  function isValidProfileUpdate() {
    // Only allow specific fields to be updated
    let allowedFields = ['displayName', 'phoneNumber', 'photoURL'];
    
    // Check if only allowed fields are being updated
    return request.resource.data.diff(resource.data).affectedKeys().hasOnly(allowedFields);
  }

  match /databases/{database}/documents {
    // Super admins have full access to all collections
    match /{document=**} {
      allow read, write: if isSuperAdmin();
    }
    
    // Customers collection rules
    match /customers/{customerId} {
      // Allow read access to authenticated users
      allow read: if isAuthenticated();
      
      // Allow create/update/delete for admin/super_admin
      allow create, update, delete: if isAdminOrAgent();
      
      // Additional validation for customer documents
      allow create: if (
        request.resource.data.name is string &&
        request.resource.data.name.size() > 0 &&
        request.resource.data.email is string &&
        request.resource.data.email.matches('^[^@]+@[^@]+\\.[^@]+$') &&
        request.resource.data.phone is string &&
        request.resource.data.phone.size() >= 10
      );
      
      // Allow updates to all fields except id and timestamps
      allow update: if (
        !('id' in request.resource.data) &&
        !('createdAt' in request.resource.data) &&
        !('updatedAt' in request.resource.data)
      );
    }

    match /vehicles/{vehicleId} {
      allow read: if isAuthenticated() && (isSuperAdmin() || isAdmin() || 
                (isAgent() && resource.data.driverId == request.auth.uid));
      
      allow create: if isAuthenticated() && isAdmin();
      
      allow update: if isAuthenticated() && 
                   (isAdmin() || 
                   (resource.data.driverId == request.auth.uid && 
                    request.resource.data.diff(resource.data).affectedKeys().hasOnly(['lastKnownLocation'])));
      
      allow delete: if isSuperAdmin();
    }
    
    match /users/{userId} {
      allow read: if request.auth != null;
      allow create, update, delete: if isAdmin();
    }
    
    match /products/{productId} {
      allow read: if isAuthenticated();
      
      allow create, update, delete: if isAuthenticated();
    }
    
    match /categories/{categoryId} {
      allow read: if isAuthenticated();
      allow create, update, delete: if isAdmin();
    }
    
    match /orders/{orderId} {
      allow read: if isOwner(resource.data.userId) || isAdmin();
      allow create: if isAuthenticated() && request.resource.data.userId == request.auth.uid;
      allow update: if isOwner(resource.data.userId) || isAdmin();
      allow delete: if isAdmin();
    }
  }
}