firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    // Allow authenticated users to read all documents
    match /{document=**} {
      allow read: if request.auth != null;
    }
    
    // Users collection rules
    match /users/{userId} {
      // Users can only write to their own document, or admins can update any user
      allow write: if request.auth != null && 
        (request.auth.uid == userId || 
         get(/databases/$(database)/documents/users/$(request.auth.uid)).data.isAdmin == true);
    }
    
    // Houses collection rules
    match /houses/{houseId} {
      // Allow admins to modify house data directly
      // Also allow any authenticated user to update the memberCount field or create the house document if it doesn't exist
      allow write: if request.auth != null && (
        get(/databases/$(database)/documents/users/$(request.auth.uid)).data.isAdmin == true || 
        (
          // For update operations, only allow incrementing memberCount field
          (request.resource.data.diff(resource.data).affectedKeys().hasOnly(['memberCount']) && 
           request.resource.data.memberCount == resource.data.memberCount + 1) ||
          // For create operations, allow any authenticated user to create a house document
          !exists(/databases/$(database)/documents/houses/$(houseId))
        )
      );
    }
    
    // Cleaning tasks collection rules
    match /cleaningTasks/{taskId} {
      // Anyone can read tasks
      allow read: if true;
      // Authenticated users can create tasks
      allow create: if request.auth != null;
      // Only admins or the user who created the task can update or delete it
      allow update, delete: if request.auth != null && 
        (request.auth.uid == resource.data.requestedBy || 
         get(/databases/$(database)/documents/users/$(request.auth.uid)).data.isAdmin == true);
    }
    
    // Task completions collection rules
    match /taskCompletions/{completionId} {
      // Anyone can read task completions
      allow read: if true;
      // Authenticated users can create task completions
      allow create: if request.auth != null;
      // Only admins can update status
      allow update: if request.auth != null && 
        get(/databases/$(database)/documents/users/$(request.auth.uid)).data.isAdmin == true;
    }
  }
}