firebase-rules.txt

// These are the Firebase Storage rules you need to set in your Firebase console
// Go to Firebase Console > Storage > Rules and paste these rules

rules_version = '2';

service firebase.storage {
  match /b/{bucket}/o {
    // Allow read access to all authenticated users
    match /{allPaths=**} {
      allow read: if request.auth != null;
    }
    
    // Allow write access to the lectures folder for authenticated users
    match /lectures/{fileName} {
      allow write: if request.auth != null;
    }
  }
}

// These are the Firestore rules you need to set in your Firebase console
// Go to Firebase Console > Firestore Database > Rules and paste these rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    // Allow authenticated users to read all documents
    match /{document=**} {
      allow read: if request.auth != null;
    }
    
    // Allow authenticated users to create and update lectures
    match /lectures/{lectureId} {
      allow create, update: if request.auth != null;
      allow delete: if request.auth != null && (
        // Allow admins to delete any lecture
        get(/databases/$(database)/documents/users/$(request.auth.uid)).data.role == 'admin' ||
        // Allow users to delete their own lectures
        resource.data.uploadedBy == request.auth.uid
      );
    }
    
    // Allow admins to manage users
    match /users/{userId} {
      allow create: if request.auth != null;
      allow update, delete: if request.auth != null && 
        get(/databases/$(database)/documents/users/$(request.auth.uid)).data.role == 'admin';
      // Allow users to update their own unreadAnnouncements
      allow update: if request.auth != null && 
        request.auth.uid == userId &&
        request.resource.data.diff(resource.data).affectedKeys().hasOnly(['unreadAnnouncements']);
    }
    
    // Allow admin and teacher roles to manage announcements
    match /announcements/{announcementId} {
      allow read: if request.auth != null;
      allow create: if request.auth != null && (
        get(/databases/$(database)/documents/users/$(request.auth.uid)).data.role == 'admin' ||
        get(/databases/$(database)/documents/users/$(request.auth.uid)).data.role == 'teacher'
      );
      allow delete: if request.auth != null && (
        // Allow admins to delete any announcement
        get(/databases/$(database)/documents/users/$(request.auth.uid)).data.role == 'admin' ||
        // Allow users to delete their own announcements
        resource.data.createdBy == request.auth.uid
      );
    }
  }
}