firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    
    // ============================================
    // HELPER FUNCTIONS
    // ============================================
    
    function isAuthenticated() {
      return request.auth != null;
    }
    
    function getUserData() {
      return get(/databases/$(database)/documents/users/$(request.auth.uid)).data;
    }
    
    function getUserRole() {
      return getUserData().role;
    }
    
    function getUserCompanyId() {
      return getUserData().companyId;
    }
    
    // Role checking functions (NEW ROLE SYSTEM)
    function isStudent() {
      return isAuthenticated() && getUserRole() == 'STUDENT';
    }
    
    function isCompany() {
      return isAuthenticated() && getUserRole() == 'COMPANY';
    }
    
    function isReviewer() {
      return isAuthenticated() && getUserRole() == 'REVIEWER';
    }
    
    // Legacy role support (for backward compatibility during migration)
    function isLegacyRecruiter() {
      return isAuthenticated() && getUserRole() == 'RECRUITER';
    }
    
    // Combined role checks
    function isCompanyOrReviewer() {
      return isCompany() || isReviewer();
    }
    
    function isVerifiedCompany() {
      return isCompany() && 
        exists(/databases/$(database)/documents/companies/$(getUserCompanyId())) &&
        get(/databases/$(database)/documents/companies/$(getUserCompanyId())).data.verified == true;
    }
    
    // Organization membership checks
    function isOrgMember(orgId) {
      return exists(/databases/$(database)/documents/organizationMembers/$(request.auth.uid + '_' + orgId));
    }
    
    function isOrgAdmin(orgId) {
      let membership = get(/databases/$(database)/documents/organizationMembers/$(request.auth.uid + '_' + orgId)).data;
      return membership.status == 'ACTIVE' && (membership.role == 'OWNER' || membership.role == 'ADMIN');
    }
    
    // Role immutability check
    function roleIsImmutable() {
      return !resource.data.keys().hasAny(['role']) || 
             resource.data.role == request.resource.data.role;
    }
    
    // ============================================
    // USERS COLLECTION
    // ============================================
    // Users can read/write their own document
    // Role is IMMUTABLE after first set
    match /users/{userId} {
      allow read: if isAuthenticated() && request.auth.uid == userId;
      
      // Allow creation only by the user themselves
      allow create: if isAuthenticated() && 
        request.auth.uid == userId &&
        request.resource.data.uid == userId &&
        // Role must be null, STUDENT, COMPANY, or REVIEWER
        (request.resource.data.role == null || 
         request.resource.data.role == 'STUDENT' || 
         request.resource.data.role == 'COMPANY' || 
         request.resource.data.role == 'REVIEWER');
      
      // Allow updates only by the user themselves
      // CRITICAL: Role cannot be changed once set (immutable)
      allow update: if isAuthenticated() && 
        request.auth.uid == userId &&
        // If role exists and is NOT null in current document, it cannot be changed
        (
          // Case 1: Role doesn't exist in current doc (new field being added)
          !('role' in resource.data) ||
          // Case 2: Role is null in current doc (first time setting)
          resource.data.role == null ||
          // Case 3: Role is being set to the same value (no change)
          resource.data.role == request.resource.data.role
        ) &&
        // Ensure role is valid if being set
        (!('role' in request.resource.data) ||
         request.resource.data.role == null ||
         request.resource.data.role == 'STUDENT' ||
         request.resource.data.role == 'COMPANY' ||
         request.resource.data.role == 'REVIEWER');
      
      allow delete: if false; // Never allow user deletion via client
    }
    
    // ============================================
    // TASKS COLLECTION
    // ============================================
    // All authenticated users can read tasks
    // Only COMPANY role can create/update tasks
    match /tasks/{taskId} {
      // Allow read for all authenticated users (no role check needed for reading)
      allow read: if isAuthenticated();
      
      // Companies can create tasks
      // Check that user document exists and has COMPANY role
      allow create: if isAuthenticated() &&
        exists(/databases/$(database)/documents/users/$(request.auth.uid)) &&
        get(/databases/$(database)/documents/users/$(request.auth.uid)).data.role == 'COMPANY' &&
        request.resource.data.keys().hasAll(['companyId', 'isActive']) &&
        request.resource.data.isActive == true;
      
      // Companies can update their own tasks
      // Check if user has COMPANY role and companyId matches
      allow update: if isAuthenticated() &&
        exists(/databases/$(database)/documents/users/$(request.auth.uid)) &&
        get(/databases/$(database)/documents/users/$(request.auth.uid)).data.role == 'COMPANY' &&
        get(/databases/$(database)/documents/users/$(request.auth.uid)).data.companyId == resource.data.companyId;
      
      allow delete: if false; // Never allow deletion (set isActive = false instead)
    }
    
    // ============================================
    // SUBMISSIONS COLLECTION
    // ============================================
    // Students can create and update their own (if not locked)
    // Reviewers and Companies can read
    match /submissions/{submissionId} {
      // Simplified read rules - allow authenticated users with proper roles
      allow read: if isAuthenticated();
      
      allow create: if isAuthenticated() && 
        exists(/databases/$(database)/documents/users/$(request.auth.uid)) &&
        get(/databases/$(database)/documents/users/$(request.auth.uid)).data.role == 'STUDENT' &&
        request.resource.data.userId == request.auth.uid &&
        request.resource.data.status == 'PENDING' &&
        request.resource.data.isLocked == false;
      
      allow update: if isAuthenticated() && (
        // Students can update their own submissions if not locked
        (resource.data.userId == request.auth.uid &&
         resource.data.isLocked == false &&
         request.resource.data.userId == resource.data.userId &&
         request.resource.data.taskId == resource.data.taskId &&
         request.resource.data.startTime == resource.data.startTime) ||
        // Companies can update submissions for their tasks (for review)
        (isCompany() &&
         resource.data.companyId == getUserCompanyId() &&
         // Can update status, score, and feedback fields
         request.resource.data.userId == resource.data.userId &&
         request.resource.data.taskId == resource.data.taskId)
      );
      
      allow delete: if false; // Never allow deletion
    }
    
    // ============================================
    // REVIEWS COLLECTION
    // ============================================
    // Only reviewers can create
    // No updates or deletes allowed (immutable)
    match /reviews/{reviewId} {
      // Students, reviewers, and companies can read reviews
      allow read: if isAuthenticated();
      
      allow create: if isAuthenticated() && 
        isReviewer() &&
        request.resource.data.reviewerId == request.auth.uid;
      
      allow update: if false; // Immutable
      allow delete: if false; // Immutable
    }
    
    // RECEIPTS COLLECTION
    // Public read (no auth required)
    // No client writes allowed (Admin SDK only)
    // Immutable forever
    match /receipts/{receiptId} {
      allow read: if true; // Public read
      allow write: if false; // Admin SDK only, immutable
      
      // AI Profile subcollection
      match /aiProfile/{profileId} {
        allow read: if true; // Public read for AI insights
        allow write: if false; // Admin SDK only
      }
    }
    
    // CANDIDATE PROFILES COLLECTION (AI aggregated profiles)
    // Public read for discovery
    match /candidateProfiles/{studentId} {
      allow read: if true; // Public read
      allow write: if false; // Admin SDK only
    }
    
    // GEMINI ANALYTICS LOGS
    // No client access (Admin SDK only)
    match /geminiAnalyticsLogs/{logId} {
      allow read: if false;
      allow write: if false; // Admin SDK only
    }
    
    // ============================================
    // SHORTLISTS COLLECTION
    // ============================================
    // Companies can save candidates to shortlists
    match /shortlists/{shortlistId} {
      allow read: if isCompany() && 
        resource.data.companyId == getUserCompanyId();
      
      allow create: if isCompany() &&
        request.resource.data.companyId == getUserCompanyId();
      
      allow update: if isCompany() &&
        resource.data.companyId == getUserCompanyId();
      
      allow delete: if isCompany() &&
        resource.data.companyId == getUserCompanyId();
    }
    
    // RECRUITER ANALYTICS COLLECTION
    // No client access (Admin SDK only)
    match /recruiterAnalytics/{analyticsId} {
      allow read: if false;
      allow write: if false; // Admin SDK only
    }
    
    // ============================================
    // COMPANIES COLLECTION
    // ============================================
    // All authenticated users can read company profiles
    // Companies can update their own profile
    match /companies/{companyId} {
      allow read: if isAuthenticated();
      
      // Allow creation during role selection (before role is fully set)
      // User must be authenticated and must be the owner
      allow create: if isAuthenticated() &&
        request.resource.data.ownerUid == request.auth.uid;
      
      // Companies can update their own profile
      allow update: if isCompany() && 
        getUserCompanyId() == companyId &&
        // Cannot change ownership
        resource.data.ownerUid == request.resource.data.ownerUid;
      
      allow delete: if false; // Never allow deletion
    }
    
    // COMPANY TASKS COLLECTION
    // Public read for discovery
    // Only verified companies can write
    match /companyTasks/{taskId} {
      allow read: if isAuthenticated();
      allow create: if false; // Created via API only
      allow update: if isVerifiedCompany() &&
        resource.data.companyId == get(/databases/$(database)/documents/users/$(request.auth.uid)).data.companyId;
      allow delete: if false; // Never allow deletion
    }
    
    // ============================================
    // PAYMENTS COLLECTION
    // ============================================
    // No client access (Admin SDK only)
    match /payments/{paymentId} {
      allow read: if isAuthenticated() && (
        // Company can read their payments
        (isCompany() && resource.data.companyId == getUserCompanyId()) ||
        // Student can read their payments
        resource.data.studentId == request.auth.uid
      );
      allow write: if false; // Admin SDK only
    }
    
    // COMPANY ACTIVITY LOGS
    // No client access (Admin SDK only)
    match /companyActivityLogs/{logId} {
      allow read: if false;
      allow write: if false; // Admin SDK only
    }
    
    // ORGANIZATIONS COLLECTION
    // Members can read their organizations
    match /organizations/{orgId} {
      allow read: if isAuthenticated();
      allow create: if false; // API only
      allow update: if isAuthenticated(); // Members can update via API
      allow delete: if false;
    }
    
    // ORGANIZATION MEMBERS COLLECTION
    // Members can read their own membership
    match /organizationMembers/{memberId} {
      allow read: if isAuthenticated();
      allow create: if false; // API only
      allow update: if false; // API only
      allow delete: if false; // API only (soft delete)
    }
    
    // CANDIDATE NOTES COLLECTION
    // Org members can read/write notes for their org
    match /candidateNotes/{noteId} {
      allow read: if isAuthenticated();
      allow create: if false; // API only
      allow update: if false; // API only
      allow delete: if false; // API only
    }
    
    // API KEYS COLLECTION
    // No client access (Admin SDK only)
    match /apiKeys/{keyId} {
      allow read: if false;
      allow write: if false; // Admin SDK only
    }
    
    // AUDIT LOGS COLLECTION
    // No client access (Admin SDK only)
    match /auditLogs/{logId} {
      allow read: if false;
      allow write: if false; // Admin SDK only
    }
    
    // ORG ANALYTICS COLLECTION
    // No client access (computed via API)
    match /orgAnalytics/{orgId} {
      allow read: if false;
      allow write: if false; // Admin SDK only
    }
    
    // RECEIPT SIGNATURES COLLECTION (Cryptographic trust)
    // Public read for verification
    match /receiptSignatures/{signatureId} {
      allow read: if true; // Public read for verification
      allow write: if false; // Admin SDK only
    }
    
    // TRUST REGISTRY (Public keys)
    // Public read for signature verification
    match /trustRegistry/{keyId} {
      allow read: if true; // Public read
      allow write: if false; // Admin SDK only
    }
    
    // REVOKED RECEIPTS
    // Public read to check revocation status
    match /revokedReceipts/{receiptId} {
      allow read: if true; // Public read
      allow write: if false; // Admin SDK only
    }
    
    // CREDENTIAL PROFILES (Public skill passports)
    // Public read if profile is public
    match /credentialProfiles/{studentId} {
      allow read: if true; // Public read (filtered by isPublic in API)
      allow create: if isAuthenticated() && request.auth.uid == studentId;
      allow update: if isAuthenticated() && request.auth.uid == studentId;
      allow delete: if false;
    }
    
    // REPUTATION SCORES
    // Public read for leaderboards
    match /reputationScores/{studentId} {
      allow read: if true; // Public read
      allow write: if false; // Admin SDK only
    }
    
    // SKILL GRAPH (Global analytics)
    // Public read
    match /skillGraph/{skill} {
      allow read: if true; // Public read
      allow write: if false; // Admin SDK only
    }
    
    // INSTITUTION PROGRAMS
    // Members can read their org's programs
    match /institutionPrograms/{programId} {
      allow read: if isAuthenticated();
      allow create: if false; // API only
      allow update: if false; // API only
      allow delete: if false;
    }
    
    // RECEIPT AUDIT TRAIL
    // No client access (compliance/legal)
    match /receiptAuditTrail/{eventId} {
      allow read: if false;
      allow write: if false; // Admin SDK only
    }
  }
}