firestore.rules

rules_version = '2';
// Updated: 2025-08-03 - Added standalone weekly assessments support

service cloud.firestore {
  match /databases/{database}/documents {

    // Helper function to check if user is admin
    function isAdmin() {
      return request.auth != null &&
             request.auth.token.email in [
               'doyextech@gmail.com',
               'ibrahimadekunle3030@gmail.com',
               'adekunleibrahim6060@gmail.com',
               'suleimanjemilat2009@gmail.com',
               'raregem015@gmail.com'
             ];
    }

    // Helper function to check if user is authenticated
    function isAuthenticated() {
      return request.auth != null;
    }

    // Helper function to check if user owns the resource
    function isOwner(userId) {
      return request.auth != null && request.auth.uid == userId;
    }

    // User profiles - users can read/write their own profile, admins can read all
    match /users/{userId} {
      allow read: if isOwner(userId) || isAdmin();
      allow create, update: if isOwner(userId) || isAuthenticated();
      allow delete: if isAdmin();
    }

    // User access control - allow authenticated writes for payment
    match /userAccess/{accessId} {
      allow read: if isOwner(accessId) || isAdmin();
      allow write: if isAdmin() || isAuthenticated() || request.auth == null; // Allow server-side payment processing
    }

    // Exam attempts - users can manage their own attempts, admins can read all
    match /examAttempts/{attemptId} {
      allow read: if isAuthenticated() || isAdmin();
      allow create, update: if isAuthenticated();
      allow delete: if isAdmin();
    }

    // Questions - authenticated users can read, only admins can write
    match /questions/{questionId} {
      allow read: if isAuthenticated();
      allow write: if isAdmin();
    }

    // Exam results - users can manage their own results, admins can read all
    match /examResults/{resultId} {
      allow read: if isAuthenticated() || isAdmin();
      allow create, update: if isAuthenticated();
      allow delete: if isAdmin();
    }

    // Feedback - authenticated users can create, admins can read all
    match /feedback/{feedbackId} {
      allow read: if isAdmin();
      allow create: if isAuthenticated();
      allow update, delete: if isAdmin();
    }

    // Access codes - only admins can manage
    match /accessCodes/{codeId} {
      allow read, write: if isAdmin();
    }

    // Payment sessions - users can manage their own, admins can read all
    match /paymentSessions/{sessionId} {
      allow read: if isAuthenticated() || isAdmin();
      allow create, update: if isAuthenticated();
      allow delete: if isAdmin();
    }

    // University data - read access for authenticated users, write for admins
    match /universities/{universityId} {
      allow read: if isAuthenticated();
      allow write: if isAdmin();
    }

    // Leaderboard data - read access for authenticated users
    match /leaderboard/{entryId} {
      allow read: if isAuthenticated();
      allow write: if isAdmin();
    }

    // Exam schedules - only admins can manage, authenticated users can read
    match /examSchedules/{scheduleId} {
      allow read: if isAuthenticated();
      allow write: if isAdmin();
    }

    // Weekly assessments - only admins can manage, authenticated users can read
    match /weeklyAssessments/{assessmentId} {
      allow read: if isAuthenticated();
      allow write: if isAdmin();
    }

    // Weekly assessment attempts - users can manage their own attempts, admins can read all
    match /weeklyAssessmentAttempts/{attemptId} {
      allow read: if isAuthenticated() || isAdmin();
      allow create, update: if isAuthenticated();
      allow delete: if isAdmin();
    }

    // Standalone weekly assessments - only admins can manage, authenticated users can read
    match /standaloneWeeklyAssessments/{assessmentId} {
      allow read: if isAuthenticated();
      allow write: if isAdmin();
    }

    // Standalone weekly assessment attempts - users can manage their own attempts, admins can read all
    match /standaloneAssessmentAttempts/{attemptId} {
      allow read: if isAuthenticated() || isAdmin();
      allow create, update: if isAuthenticated();
      allow delete: if isAdmin();
    }

    // RM User Access - allow server-side operations for payment processing
    match /rmUserAccess/{userId} {
      allow read: if isOwner(userId) || isAdmin() || request.auth == null; // Allow server-side reads too
      allow write: if isAdmin() || isAuthenticated() || request.auth == null; // Allow server-side operations
    }

    // Transactions - allow authenticated users to read their own, create during payment
    match /transactions/{transactionId} {
      allow read: if isAuthenticated() || isAdmin();
      allow create, update: if isAuthenticated() || request.auth == null; // Allow server-side payment processing
      allow delete: if isAdmin();
    }

    // RM Exam Attempts - users can manage their own attempts, admins can read all, allow server-side operations
    match /rmExamAttempts/{attemptId} {
      allow read: if isAuthenticated() || isAdmin() || request.auth == null; // Allow server-side reads
      allow create, update: if isAuthenticated() || request.auth == null; // Allow server-side writes
      allow delete: if isAdmin();
    }

    // RM Questions - authenticated users can read, only admins can write
    match /rmQuestions/{questionId} {
      allow read: if isAuthenticated();
      allow write: if isAdmin();
    }

    // Payments - users can read their own payments, admins can read all
    match /payments/{paymentId} {
      allow read: if isAuthenticated() || isAdmin();
      allow create, update: if isAuthenticated();
      allow delete: if isAdmin();
    }

    // User Activity - users can read their own activity, admins can read all
    match /userActivity/{activityId} {
      allow read: if isAuthenticated() || isAdmin();
      allow create, update: if isAuthenticated();
      allow delete: if isAdmin();
    }

    // Study Groups - authenticated users can read and create, members can update
    match /studyGroups/{groupId} {
      allow read: if isAuthenticated();
      allow create: if isAuthenticated();
      allow update, delete: if isAuthenticated() || isAdmin();
    }

    // RM Question Banks - authenticated users can read, admins and system can write
    match /rmQuestionBanks/{bankId} {
      allow read: if isAuthenticated();
      allow write: if isAdmin() || isAuthenticated();
    }

    // Standalone RM Exams - authenticated users can read, only admins can write
    match /standaloneRMExams/{examId} {
      allow read: if isAuthenticated();
      allow write: if isAdmin();
    }

    // Standalone RM Exam Attempts - users can manage their own attempts, admins can read all, allow server-side operations
    match /standaloneRMAttempts/{attemptId} {
      allow read: if isAuthenticated() || isAdmin() || request.auth == null; // Allow server-side reads
      allow create, update: if isAuthenticated() || request.auth == null; // Allow server-side writes
      allow delete: if isAdmin();
    }

    // Default deny all other documents
    match /{document=**} {
      allow read, write: if false;
    }
  }
}