firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {

    // Users collection - all authenticated users can read (for leaderboard), write own only
    match /users/{userId} {
      allow read: if request.auth != null;
      allow write: if request.auth != null && request.auth.uid == userId;
    }

    // Challenge sessions - read/write own sessions
    match /challengeSessions/{sessionId} {
      allow read, write: if request.auth != null && (
        sessionId.matches('^' + request.auth.uid + '_.*') ||
        resource.data.uid == request.auth.uid
      );
    }

    // Events collection - read all, write via backend only
    match /events/{eventId} {
      allow read: if request.auth != null;
      allow write: if false; // Backend only via Admin SDK
    }

    // Pending rewards - read own, write via backend only
    match /pending_rewards/{rewardId} {
      allow read: if request.auth != null;
      allow write: if false; // Backend only
    }

    // System collection - read only
    match /system/{doc} {
      allow read: if request.auth != null;
      allow write: if false; // Admin only
    }

    // Partners collection - read only
    match /partners/{partnerId} {
      allow read: if request.auth != null;
      allow write: if false; // Admin only
    }

    // Certificates — public read for verification links, authenticated write (owner only)
    match /certificates/{hash} {
      allow read: if true; // Public — anyone with the link can verify
      allow create: if request.auth != null &&
                       request.resource.data.uid == request.auth.uid;
      allow update, delete: if false; // Immutable once issued
    }

    // Weekly SDG Tasks — public read so unauthenticated preview works;
    // write is backend/admin SDK only (Student B seeds via API)
    match /weekly_tasks/{taskId} {
      allow read: if true;
      allow write: if false; // Admin SDK only (api/seed-weekly-task.js)
    }

    // Weekly Completions — students create own submissions, community votes
    // Community upvote/downvote replaces admin approval
    match /weekly_completions/{docId} {
      // Anyone authenticated can read (for community feed)
      allow read: if request.auth != null;

      // Students can create their own submissions
      allow create: if request.auth != null &&
                       request.resource.data.uid == request.auth.uid;

      // Any authenticated user can update (for community voting: upvoters, downvoters, netScore)
      allow update: if request.auth != null;

      allow delete: if false; // Never delete submissions
    }

    // Cheat logs — individual violation events for audit trail
    // Server-only writes; students can read their own logs
    match /cheatLogs/{logId} {
      allow read: if request.auth != null &&
                     resource.data.userId == request.auth.uid;
      allow write: if false; // Server-only via Admin SDK
    }

    // Violation summaries — per-user-per-challenge violation count (tamper-resistant)
    // Students can read their own summary; writes are server-only
    match /violationSummaries/{docId} {
      allow read: if request.auth != null &&
                     docId.matches('^' + request.auth.uid + '_.*');
      allow write: if false; // Server-only via Admin SDK
    }
  }
}