firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {

    function isSignedIn() {
      return request.auth != null;
    }

    // Master admins: Only Antonio and Robert can truly delete documents
    function canDelete() {
      return isSignedIn() 
        && 'email' in request.auth.token 
        && request.auth.token.email in [
          "antonioalx66@gmail.com",
          "antonio@affogato.co",
          "robert@affogato.co"
        ];
    }

    function isSuperAdmin() {
      return canDelete() || (
        isSignedIn() 
        && 'roles' in request.auth.token 
        && request.auth.token.roles.hasAny(["ADMIN", "OWNER", "SUPERADMIN"])
      );
    }

    function isEmailInCoop(coopId) {
      return exists(/databases/$(database)/documents/permissions/$(coopId))
        && 'user' in get(/databases/$(database)/documents/permissions/$(coopId)).data
        && request.auth.token.email in get(/databases/$(database)/documents/permissions/$(coopId)).data.user;
    }

    function hasCoopPermission() {
      return isSignedIn() 
        && 'email' in request.auth.token 
        && (
          isEmailInCoop("proexo") ||
          isEmailInCoop("comsa") ||
          isEmailInCoop("copranil") ||
          isEmailInCoop("copracnil") ||
          isEmailInCoop("cafepsa") ||
          isEmailInCoop("commovel")
        );
    }

    function canWrite() {
      return isSuperAdmin() || hasCoopPermission();
    }

    // Permissions collection:
    // Anyone can read
    // Only Antonio & Robert can modify permissions
    match /permissions/{permId} {
      allow read: if true;
      allow write: if canDelete();
    }

    // Business collections (farms, farmers, varieties, batches, certifications, companies, etc.)
    // Public read for everyone (unauthenticated and authenticated)
    // Create & update: SuperAdmins and authorized cooperatives (including PROEXO)
    // Delete: strictly restricted to Antonio & Robert only
    match /{collection}/{docId} {
      allow read: if true;
      allow create, update: if collection != 'permissions' && canWrite();
      allow delete: if canDelete();

      match /{subDoc=**} {
        allow read: if true;
        allow create, update: if collection != 'permissions' && canWrite();
        allow delete: if canDelete();
      }
    }
  }
}