firestore.rules

// =============================================================
// firestore.rules — Firestore Security Rules (HARDENED v7b)
// =============================================================
// Password hashes have been removed from all user documents.
// Users collection allows public read (safe now — no sensitive data).
// Firebase Auth handles all password verification server-side.
// =============================================================

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {

    function isRealUser() {
      return request.auth != null
          && request.auth.token.firebase.sign_in_provider != 'anonymous';
    }

    // Users: public read (passwordHash removed — only name/email/role/dept)
    match /users/{docId} {
      allow read: if true;
      allow write: if isRealUser();
    }

    match /subjects/{docId} {
      allow read, write: if isRealUser();
    }

    match /questionnaires/{docId} {
      allow read, write: if isRealUser();
    }

    // Settings: public read (college domain needed on login pages)
    match /settings/{docId} {
      allow read: if true;
      allow write: if isRealUser();
    }

    match /enrollments/{docId} {
      allow read, write: if isRealUser();
    }

    match /responses/{docId} {
      allow read, write: if isRealUser();
    }

    match /attendance/{docId} {
      allow read, write: if isRealUser();
    }

    match /notifications/{docId} {
      allow read, write: if isRealUser();
    }

    match /timetables/{docId} {
      allow read, write: if isRealUser();
    }

    match /{document=**} {
      allow read, write: if false;
    }
  }
}