firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /listings {
      allow list: if true;  // Allow listing collection queries, essential for features like filtering and pagination.
    }

    // Listings collection rules
    match /listings/{listingId} {
      allow read: if true; // Anyone can view listings
      allow create: if request.auth != null; // Must be logged in to create
      allow update, delete: if request.auth != null && 
        request.auth.uid == resource.data.createdBy; // Only creator can modify
    }

    match /accounts {
      allow list: if isPublicUser() || isPublicGroup();

      // Public Group access
      function isPublicGroup() {
        return (resource.data.privacy == 'public' && resource.data.type == 'group');
      }

      // Public User access
      function isPublicUser() {
        return (request.auth != null && resource.data.privacy == 'public' && resource.data.type == 'user');
      }
    }

    // Match the Account collection
    match /accounts/{accountId} {
      
      function isAccountOwner() {
        return request.auth != null && request.auth.uid == accountId;
      }

      // Friends-only access
      function isAcceptedFriend() {
        return (request.auth != null && exists(/databases/$(database)/documents/accounts/$(accountId)/relatedAccounts/$(request.auth.uid))
          && get(/databases/$(database)/documents/accounts/$(accountId)/relatedAccounts/$(request.auth.uid)).data.type == 'user'
          && get(/databases/$(database)/documents/accounts/$(accountId)/relatedAccounts/$(request.auth.uid)).data.status == 'accepted');
      }

      // Groups-only access
      function isAcceptedGroup() {
        return (request.auth != null && exists(/databases/$(database)/documents/accounts/$(accountId)/relatedAccounts/$(request.auth.uid))
          && get(/databases/$(database)/documents/accounts/$(accountId)/relatedAccounts/$(request.auth.uid)).data.type == 'group'
          && get(/databases/$(database)/documents/accounts/$(accountId)/relatedAccounts/$(request.auth.uid)).data.status == 'accepted');
      }

      // Public Group access
      function isPublicGroup() {
        return (resource.data.privacy == 'public' && resource.data.type == 'group');
      }

      // Public User access
      function isPublicUser() {
        return (request.auth != null && resource.data.privacy == 'public' && resource.data.type == 'user');
      }

      // Allow read if the user is accessing their own account
      allow read: if (isAccountOwner() || isAcceptedFriend() || isAcceptedGroup() || isPublicGroup() || isPublicUser());

      // General write rule (customize as needed)
      allow create, write: if isAccountOwner();
    }

    // Rules for relatedAccount
    match /accounts/{accountId}/relatedAccounts/{relatedAccountId} {
      allow create, read, write, delete: if request.auth.uid != null; // Only the user can write to their own data
    }
    
    // Rules for AppFeedback
    match /feedback/{accountId} {
      function isAccountOwner() {
        return request.auth.uid == accountId;
      }

      allow create: if isAccountOwner();
      allow read, write: if request.auth.uid != null; // Only logged in users can read and write feedback
      allow delete: if false;
    }
  }
}