firestore.rules

rules_version = '2';

service cloud.firestore {
  match /databases/{database}/documents {
    
    // Helper functions
    function isSignedIn() {
      return request.auth != null;
    }
    
    function isOwner(userId) {
      return isSignedIn() && request.auth.uid == userId;
    }
    function getIssue(issueId) {
      return get(/databases/$(database)/documents/issues/$(issueId)).data;
    }
    function isFollowerOf(userId) {
      return isSignedIn() && exists(/databases/$(database)/documents/users/$(userId)/followers/$(request.auth.uid));
    }
    
    // Issues collection
    match /issues/{issueId} {
      // Visibility logic:
      // public: everyone
      // private: owner, or followers if showPrivateToFollowers == true
      // draft: owner only
      allow read: if (
          // Legacy documents without visibility field treated as public
          !('visibility' in resource.data)
          || resource.data.visibility == 'public'
          || isOwner(resource.data.createdBy)
          || (
            resource.data.visibility == 'private'
            && isFollowerOf(resource.data.createdBy)
            && get(/databases/$(database)/documents/users/$(resource.data.createdBy)).data.showPrivateToFollowers == true
          )
        );
      
      // Only authenticated users can create issues
      allow create: if isSignedIn() 
        && request.resource.data.keys().hasAll(['title', 'description', 'category', 'status', 'votes', 'createdBy'])
        && request.resource.data.votes == 0
        && request.resource.data.status == 'received'
        && request.resource.data.createdBy == request.auth.uid
        && request.resource.data.title.size() > 0 && request.resource.data.title.size() <= 200
        && request.resource.data.description.size() > 0 && request.resource.data.description.size() <= 5000
        && (request.resource.data.visibility in ['public','private','draft'] || !('visibility' in request.resource.data));
      
      // Authenticated users can update issues
      // Owner-only for status/visibility/resolution/progress; votes can be updated by vote logic
      allow update: if isSignedIn() && (
        // Owner-only changes
        (isOwner(resource.data.createdBy) && (
          (request.resource.data.status in ['received','in_progress','resolved'])
          || (request.resource.data.visibility in ['public','private','draft'])
          || ('resolution' in request.resource.data
              && request.resource.data.resolution.keys().hasAll(['message','resolvedAt','resolvedBy'])
              && request.resource.data.status == 'resolved')
          || ('progressUpdates' in request.resource.data)
        ))
        // Vote count numeric adjustment (performed by batched vote logic)
        || (request.resource.data.diff(resource.data).affectedKeys().hasOnly(['votes','updatedAt']))
      );
      
      // Only owners can delete their issues
      allow delete: if isOwner(resource.data.createdBy);
      
      // Votes subcollection - tracks individual user votes
      match /votes/{userId} {
        // Anyone can read votes to see who voted
        allow read: if true;
        
        // Users can only create/update their own vote
        // Can vote on issues they don't own, OR on anonymous issues (even if they own it)
        allow create, update: if isSignedIn() 
          && request.auth.uid == userId
          && (get(/databases/$(database)/documents/issues/$(issueId)).data.anonymous == true
              || get(/databases/$(database)/documents/issues/$(issueId)).data.createdBy != request.auth.uid)
          && request.resource.data.vote in [-1, 1];
        
        // Users can delete their own vote
        allow delete: if isSignedIn() && request.auth.uid == userId;
      }
    }
    
    // Users collection (for user profiles)
    match /users/{userId} {
      // Anyone can read user profiles
      allow read: if true;
      
      // Users can only write their own profile
      allow write: if isOwner(userId);

      // Followers subcollection
      match /followers/{followerId} {
        allow read: if true;
        allow create: if isSignedIn() && request.auth.uid == followerId;
        allow delete: if isSignedIn() && request.auth.uid == followerId;
        allow update: if false; // no updates, just create/delete doc
      }

      // Following subcollection (mirrors for quick lookups)
      match /following/{targetId} {
        allow read: if true;
        allow create: if isSignedIn() && request.auth.uid == userId; // user adds someone they follow
        allow delete: if isSignedIn() && request.auth.uid == userId;
        allow update: if false;
      }
    }
    
    // Comments collection
    match /comments/{commentId} {
      // Anyone can read comments
      allow read: if true;
      
      // Create comments (updated):
      // - Authenticated users can always create comments on anonymous issues
      // - Non-owners can create top-level or reply comments on non-anonymous issues
      // - Issue owner may ONLY create reply comments (must have parentId)
      allow create: if isSignedIn()
        && request.resource.data.keys().hasAll(['issueId','userId','userName','content','createdAt','likes'])
        && request.resource.data.likes == 0
        && request.resource.data.userId == request.auth.uid
        && request.resource.data.content.size() > 0 && request.resource.data.content.size() <= 2000
        && (
          // Anonymous issue: anyone can comment (top-level or reply)
          getIssue(request.resource.data.issueId).anonymous == true
          || (
            // Non-anonymous issue logic
            // Non-owner commenting (top-level or reply)
            getIssue(request.resource.data.issueId).createdBy != request.auth.uid
            // Owner replying only (must have parentId)
            || (getIssue(request.resource.data.issueId).createdBy == request.auth.uid && 'parentId' in request.resource.data && request.resource.data.parentId != null && request.resource.data.parentId != '')
          )
        );
      
      // Update comments (extended):
      // - Author can update own comment (full edits currently limited client-side)
      // - Likes count may be updated optimistically
      // - Issue owner can pin/unpin ANY comment on their issue (pinnedAt/pinnedBy only)
      allow update: if isSignedIn() && (
          resource.data.userId == request.auth.uid
          || (request.resource.data.diff(resource.data).affectedKeys().hasOnly(['likes']))
          || (
            // Pin/unpin: only issue owner and only pinnedAt/pinnedBy fields
            request.resource.data.diff(resource.data).affectedKeys().hasOnly(['pinnedAt','pinnedBy'])
            && getIssue(resource.data.issueId).createdBy == request.auth.uid
          )
        );
      
      // Users can delete their own comments, or issue owners can delete comments on their issues
      allow delete: if isSignedIn() 
        && (resource.data.userId == request.auth.uid
            || ('issueId' in resource.data && getIssue(resource.data.issueId).createdBy == request.auth.uid));
      
      // Comment likes subcollection - tracks individual user likes
      match /likes/{userId} {
        // Anyone can read likes to see who liked
        allow read: if true;
        
        // Users can only create/update/delete their own like
        allow create, update: if isSignedIn() && request.auth.uid == userId;
        allow delete: if isSignedIn() && request.auth.uid == userId;
      }
    }

    // Conversations (private messages between users)
    match /conversations/{conversationId} {
      allow read: if isSignedIn() && request.auth.uid in resource.data.participants;
      allow create: if isSignedIn() && request.resource.data.participants is list
        && request.auth.uid in request.resource.data.participants
        && request.resource.data.participants.size() == 2; // two-user DM for now
      allow update: if isSignedIn() && request.auth.uid in resource.data.participants;
      allow delete: if false; // retain history

      match /messages/{messageId} {
        allow read: if isSignedIn() && request.auth.uid in get(/databases/$(database)/documents/conversations/$(conversationId)).data.participants;
        allow create: if isSignedIn()
          && request.resource.data.keys().hasAll(['senderId','content','createdAt'])
          && request.resource.data.senderId == request.auth.uid
          && request.resource.data.content.size() > 0 && request.resource.data.content.size() <= 4000
          && request.auth.uid in get(/databases/$(database)/documents/conversations/$(conversationId)).data.participants;
        allow update: if false;
        allow delete: if false;
      }
    }

    // User reports collection (for reporting users)
    match /reports/{reportId} {
      // Allow authenticated users to read all reports
      // We'll do filtering in the application
      allow read: if isSignedIn();
      
      // Authenticated users can create reports
      allow create: if isSignedIn()
        && request.resource.data.keys().hasAll(['reportedUserId','reportedUserName','reporterId','reporterName','reason','details','status','createdAt','reportCount','reasonCount'])
        && request.resource.data.reporterId == request.auth.uid
        && request.resource.data.status == 'pending'
        && request.resource.data.reportCount == 1
        && request.resource.data.reasonCount == 1
        && request.resource.data.reason.size() > 0
        && request.resource.data.details.size() > 0 && request.resource.data.details.size() <= 5000;
      
      // Allow reported user to add clarification (one-time only, cannot edit)
      // Allow increment operations for reportCount and reasonCount (can be independent)
      allow update: if isSignedIn() && (
        // Reported user can add clarification (only if not already set)
        (resource.data.reportedUserId == request.auth.uid
          && !('clarification' in resource.data)
          && request.resource.data.diff(resource.data).affectedKeys().hasOnly(['clarification', 'clarificationBy', 'clarificationAt', 'updatedAt'])
          && request.resource.data.clarificationBy == request.auth.uid
          && request.resource.data.clarification.size() > 0
          && request.resource.data.clarification.size() <= 5000)
        // Allow increment for reportCount only (different reason)
        || request.resource.data.diff(resource.data).affectedKeys().hasOnly(['reportCount', 'updatedAt'])
        // Allow increment for both reportCount and reasonCount (same reason)
        || request.resource.data.diff(resource.data).affectedKeys().hasOnly(['reportCount', 'reasonCount', 'updatedAt'])
      );
      
      // Only admins can delete reports
      allow delete: if false;
      
      // Details subcollection for additional reporter information
      match /details/{detailId} {
        // Authenticated users can read details
        allow read: if isSignedIn();
        
        // Authenticated users can add details to reports (includes reason for multi-reason support)
        allow create: if isSignedIn()
          && request.resource.data.keys().hasAll(['reporterId','reporterName','reason','details','createdAt'])
          && request.resource.data.reporterId == request.auth.uid
          && request.resource.data.reason.size() > 0
          && request.resource.data.details.size() > 0 && request.resource.data.details.size() <= 5000;
        
        // No updates or deletes to details
        allow update: if false;
        allow delete: if false;
      }
      
      // Votes subcollection for community voting
      match /votes/{voteId} {
        // Authenticated users can read votes
        allow read: if isSignedIn();
        
        // Authenticated users can create votes
        allow create: if isSignedIn()
          && request.resource.data.keys().hasAll(['userId','voteType','createdAt'])
          && request.resource.data.userId == request.auth.uid
          && request.resource.data.voteType in ['upvote', 'downvote']
          && request.resource.data.createdAt == request.time;
        
        // Users can only delete their own votes (no updates - vote is immutable)
        allow delete: if isSignedIn() && resource.data.userId == request.auth.uid;
      }
    }

    // Comment reports collection (for reporting comments)
    match /comment_reports/{reportId} {
      // Allow authenticated users to read all comment reports
      // We'll do filtering in the application
      allow read: if isSignedIn();
      
      // Authenticated users can create comment reports
      allow create: if isSignedIn()
        && request.resource.data.keys().hasAll(['commentId','commentText','commentAuthorName','commentAuthorId','issueId','issueTitle','reporterId','reporterName','reason','details','status','createdAt','reportCount','reasonCount'])
        && request.resource.data.reporterId == request.auth.uid
        && request.resource.data.status == 'pending'
        && request.resource.data.reportCount == 1
        && request.resource.data.reasonCount == 1
        && request.resource.data.reason.size() > 0
        && request.resource.data.details.size() > 0 && request.resource.data.details.size() <= 5000;
      
      // Issue owners can update comment reports (dismiss/resolve them)
      // Also allow increment operations for reportCount and reasonCount
      allow update: if isSignedIn() && (
        // Issue owner can dismiss or resolve
        (
          (
            ('issueOwnerId' in resource.data && resource.data.issueOwnerId == request.auth.uid)
            || ('issueId' in resource.data && getIssue(resource.data.issueId).createdBy == request.auth.uid)
          )
          && request.resource.data.diff(resource.data).affectedKeys().hasOnly(['status', 'updatedAt'])
          && request.resource.data.status in ['dismissed', 'resolved']
        )
        // Allow increment for reportCount only (different reason)
        || request.resource.data.diff(resource.data).affectedKeys().hasOnly(['reportCount', 'updatedAt'])
        // Allow increment for both reportCount and reasonCount (same reason)
        || request.resource.data.diff(resource.data).affectedKeys().hasOnly(['reportCount', 'reasonCount', 'updatedAt'])
      );
      
      // Only admins can delete comment reports
      allow delete: if false;
      
      // Details subcollection for additional reporter information
      match /details/{detailId} {
        // Authenticated users can read details
        allow read: if isSignedIn();
        
        // Authenticated users can add details to reports (includes reason for multi-reason support)
        allow create: if isSignedIn()
          && request.resource.data.keys().hasAll(['reporterId','reporterName','reason','details','createdAt'])
          && request.resource.data.reporterId == request.auth.uid
          && request.resource.data.reason.size() > 0
          && request.resource.data.details.size() > 0 && request.resource.data.details.size() <= 5000;
        
        // No updates or deletes to details
        allow update: if false;
        allow delete: if false;
      }
      
      // Votes subcollection for community voting
      match /votes/{voteId} {
        // Authenticated users can read votes
        allow read: if isSignedIn();
        
        // Authenticated users can create votes
        allow create: if isSignedIn()
          && request.resource.data.keys().hasAll(['userId','voteType','createdAt'])
          && request.resource.data.userId == request.auth.uid
          && request.resource.data.voteType in ['upvote', 'downvote']
          && request.resource.data.createdAt == request.time;
        
        // Users can only delete their own votes (no updates - vote is immutable)
        allow delete: if isSignedIn() && resource.data.userId == request.auth.uid;
      }
    }
  }
}