Catalog

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {

    // ⚠️ Replace with YOUR real admin email(s) — must match ADMIN_EMAILS in the app
    function isSuperAdmin() {
      return request.auth != null &&
        request.auth.token.email in ["barwaryayan@gmail.com"];
    }

    function myManagedUser() {
      return get(/databases/$(database)/documents/managed_users/$(request.auth.uid));
    }

    function isCoAdmin() {
      return request.auth != null &&
        myManagedUser().data.role == "co_admin" &&
        myManagedUser().data.disabled != true;
    }

    function isActiveManagedUser() {
      return request.auth != null &&
        exists(/databases/$(database)/documents/managed_users/$(request.auth.uid)) &&
        myManagedUser().data.disabled != true;
    }

    // Admin + co_admin can create/edit; ONLY Admin can delete (incl. move-to-trash).
    match /models/{document=**} {
      allow read: if isActiveManagedUser() || isSuperAdmin();
      allow create, update: if isSuperAdmin() || isCoAdmin();
      allow delete: if isSuperAdmin();
    }
    match /folders/{document=**} {
      allow read: if isActiveManagedUser() || isSuperAdmin();
      allow create: if isSuperAdmin() || isCoAdmin();
      // co_admin may edit folder content, but cannot move it to (or out of) Trash —
      // that requires the "deleted" field to change, which is Admin-only.
      allow update: if isSuperAdmin() ||
        (isCoAdmin() && request.resource.data.deleted == resource.data.deleted);
      allow delete: if isSuperAdmin();
    }

    // Only the Admin manages accounts (create / role / disable / delete).
    // Every signed-in account may read this collection (needed for the app's
    // own role lookup), but only the Admin can write to it.
    match /managed_users/{uid} {
      allow read: if request.auth != null;
      allow write: if isSuperAdmin();
    }

    match /login_logs/{document=**} {
      allow read, write: if request.auth != null;
    }

    match /app_settings/{document=**} {
      allow read: if true;
      allow write: if isSuperAdmin() || isCoAdmin();
    }
  }
}