firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    // Helper functions
    function isAuthenticated() {
      return request.auth != null;
    }
    
    function getUserDoc() {
      return get(/databases/$(database)/documents/users/$(request.auth.uid));
    }

    function userData() {
      return getUserDoc().data;
    }

    function userExists() {
      return exists(/databases/$(database)/documents/users/$(request.auth.uid));
    }
    
    function isAdmin() {
      return isAuthenticated() && userExists() && userData().role == 'admin';
    }
    
    function isTrainer() {
      return isAuthenticated() && userExists() && (userData().role == 'trainer' || userData().role == 'admin');
    }
    
    function isMember() {
      return isAuthenticated() && userExists() && userData().status == 'active';
    }
    
    function isOwner(uid) {
      return isAuthenticated() && request.auth.uid == uid;
    }

    // Users collection
    match /users/{userId} {
      allow read: if isAuthenticated();
      allow create: if isAdmin();
      allow update: if isAdmin() || isOwner(userId);
      allow delete: if isAdmin();

      // Notifications subcollection
      match /notifications/{notificationId} {
        allow read: if isOwner(userId);
        // Dùng isTrainer() để cho phép Admin/Trainer tạo thông báo cho bất kỳ ai
        allow create: if isTrainer();
        allow update: if isOwner(userId);
        allow delete: if isOwner(userId);
      }
    }

    // Access Requests collection
    match /accessRequests/{requestId} {
      // Cho phép đọc nếu là admin HOẶC là chủ sở hữu request
      allow read: if isAuthenticated() && (
        (userExists() && userData().role == 'admin') 
        || (resource != null && resource.data.uid == request.auth.uid)
        || (request.query.limit != null && request.query.limit <= 10) // Fallback cho query list của chính mình
      );
      allow create: if isAuthenticated() && request.resource.data.uid == request.auth.uid;
      allow update, delete: if isAdmin();
    }

    // Sessions collection
    match /sessions/{sessionId} {
      allow read: if isMember();
      allow create, update, delete: if isTrainer();

      // Attendance subcollection
      match /attendance/{attendanceId} {
        allow read: if isMember();
        allow create: if isMember() && attendanceId == request.auth.uid;
        allow update: if false;
        allow delete: if isAdmin();
      }
    }

    // Attendance Windows collection
    match /attendanceWindows/{sessionId} {
      allow read: if isMember();
      allow create, update, delete: if isTrainer();
    }

    // Assignments collection
    match /assignments/{assignmentId} {
      allow read: if isMember();
      allow create, update, delete: if isTrainer();

      // Submissions subcollection
      match /submissions/{submissionId} {
        allow read: if isTrainer() || (isMember() && submissionId == request.auth.uid);
        allow create: if isMember() && submissionId == request.auth.uid;
        allow update: if (isMember() && submissionId == request.auth.uid && !('score' in request.resource.data)) 
                      || isTrainer();
        allow delete: if isAdmin();
      }
    }

    // Quizzes collection
    match /quizzes/{quizId} {
      allow read: if isMember();
      allow create, update, delete: if isTrainer();

      match /attempts/{attemptId} {
        allow read: if isTrainer() || (isMember() && attemptId == request.auth.uid);
        allow create: if isMember() && attemptId == request.auth.uid;
        allow update: if false;
        allow delete: if isAdmin();
      }
    }

    // Announcements collection
    match /announcements/{announcementId} {
      allow read: if isMember();
      allow create, update, delete: if isTrainer();
    }
  }
}