firestore.rules

rules_version = '2';

service cloud.firestore {
  match /databases/{database}/documents {
    // Users can read and write their own account documents
    match /accounts/{userId} {
      allow read: if request.auth != null;
      allow write: if request.auth != null && request.auth.uid == userId;
    }
    
    // Users can read and write their own points transactions
    match /pointsTransactions/{transactionId} {
      allow read, write: if request.auth != null && resource.data.userId == request.auth.uid;
    }
    
    // Allow reading demo progress for authenticated users
    match /demoProgress/{progressId} {
      allow read, write: if request.auth != null && resource.data.userId == request.auth.uid;
    }
    
    // Mandatory feedback collection - users can submit feedback, admins can read all
    match /mandatory_feedback/{feedbackId} {
      allow create: if request.auth != null && 
        request.auth.uid == request.resource.data.userId &&
        request.resource.data.keys().hasAll(['userId', 'demoId', 'demoName', 'rating', 'feedback', 'difficulty', 'wouldRecommend', 'completionTime', 'timestamp']);
      allow read: if request.auth != null && 
        (request.auth.uid == resource.data.userId || 
         request.auth.token.admin == true);
      allow update, delete: if false; // Feedback is immutable once submitted
    }
    
    // Leaderboard - public read, no write
    match /leaderboard/{entryId} {
      allow read: if true;
      allow write: if false;
    }
    
    // Analytics - read for authenticated users
    match /analytics/{document=**} {
      allow read: if request.auth != null;
      allow write: if false; // Only server-side writes allowed
    }
  }
}