firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    // Helper function to check if user is authenticated
    function isAuthenticated() {
      return request.auth != null;
    }
    
    // Helper function to check if user owns the document
    function isOwner(userId) {
      return isAuthenticated() && request.auth.uid == userId;
    }
    
    // Users collection
    match /users/{userId} {
      // Users can read their own profile and other users' profiles (for public info)
      allow read: if isAuthenticated();
      
      // Users can create their own profile during signup
      allow create: if isAuthenticated() && request.auth.uid == userId;
      
      // Users can update their own profile
      allow update: if isOwner(userId);
    }
    
    // Bounties collection
    match /bounties/{bountyId} {
      // Anyone authenticated can read bounties
      allow read: if isAuthenticated();
      
      // Only companies can create bounties
      allow create: if isAuthenticated() 
        && exists(/databases/$(database)/documents/users/$(request.auth.uid))
        && get(/databases/$(database)/documents/users/$(request.auth.uid)).data.role == 'COMPANY';
      
      // Only the creator can update their own bounties
      allow update: if isAuthenticated() 
        && resource.data.companyUid == request.auth.uid;
      
      // Only the creator can delete their own bounties
      allow delete: if isAuthenticated() 
        && resource.data.companyUid == request.auth.uid;
    }
    
    // Submissions collection
    match /submissions/{submissionId} {
      // Developers can read their own submissions
      allow read: if isAuthenticated() 
        && (resource.data.developerUid == request.auth.uid 
            || exists(/databases/$(database)/documents/bounties/$(resource.data.bountyId))
            && get(/databases/$(database)/documents/bounties/$(resource.data.bountyId)).data.companyUid == request.auth.uid);
      
      // Only developers can create submissions
      allow create: if isAuthenticated() 
        && exists(/databases/$(database)/documents/users/$(request.auth.uid))
        && get(/databases/$(database)/documents/users/$(request.auth.uid)).data.role == 'DEVELOPER';
      
      // Companies can update submissions for their bounties
      allow update: if isAuthenticated() 
        && exists(/databases/$(database)/documents/bounties/$(resource.data.bountyId))
        && get(/databases/$(database)/documents/bounties/$(resource.data.bountyId)).data.companyUid == request.auth.uid;
    }
    
    // Transactions collection
    match /transactions/{transactionId} {
      // Users can read transactions they're involved in
      allow read: if isAuthenticated() 
        && (resource.data.fromUserId == request.auth.uid 
            || resource.data.toUserId == request.auth.uid);
      
      // Only system/companies can create transactions
      allow create: if isAuthenticated() 
        && exists(/databases/$(database)/documents/users/$(request.auth.uid))
        && get(/databases/$(database)/documents/users/$(request.auth.uid)).data.role == 'COMPANY';
    }
  }
}