firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {

    // =======================================
    //  Helper Functions
    // =======================================

    function isAuthenticated() {
      return request.auth != null;
    }

    function getUserData() {
      return get(/databases/$(database)/documents/users/$(request.auth.uid)).data;
    }

    function isSuperAdmin() {
      return isAuthenticated() && getUserData().role == 'super_admin';
    }

    function isAdminOrAbove() {
      return isAuthenticated() && getUserData().role in ['admin', 'super_admin'];
    }

    function isTeacherOrAbove() {
      return isAuthenticated() && getUserData().role in ['teacher', 'admin', 'super_admin'];
    }

    // =======================================
    //  Users Collection
    // =======================================
    match /users/{userId} {
      allow read: if isAuthenticated() && (request.auth.uid == userId || isAdminOrAbove());
      allow create: if isSuperAdmin();
      allow update: if isSuperAdmin() || request.auth.uid == userId;
      allow delete: if isSuperAdmin();
    }

    // =======================================
    //  Exam Data Collection (UPDATED FOR PUBLIC READ)
    // =======================================
    match /exams/{examId} {
      // যে কেউ লগইন ছাড়াই এক্সাম কার্ড ও রেজাল্ট দেখতে পারবে
      allow read: if true; 
      
      allow create, update: if isTeacherOrAbove();
      allow delete: if isAdminOrAbove();
    }

    // =======================================
    //  Exam Configs & Academic Structure
    // =======================================
    match /examConfigs/{configId} {
      allow read: if true; // রেজাল্ট রেন্ডার করার জন্য এটিও পাবলিক রাখা হয়েছে
      allow create, update: if isTeacherOrAbove();
      allow delete: if isAdminOrAbove();
    }

    match /academicStructure/{docId} {
      allow read: if true; // ড্রপডাউন মেনুগুলোর জন্য এটি পাবলিক রাখা হয়েছে
      allow write: if isAdminOrAbove();
    }

    // =======================================
    //  Students Collection
    // =======================================
    match /students/{studentId} {
      // ব্যক্তিগত প্রোফাইল সুরক্ষার জন্য এটি শুধু অথেনটিকেটেড ইউজারদের জন্য
      allow read: if isAuthenticated();
      allow create, update: if isTeacherOrAbove();
      allow delete: if isAdminOrAbove();
    }

    // =======================================
    //  Teacher Assignments & Access Control
    // =======================================
    match /teacher_assignments/{assignmentId} {
      allow read: if isAuthenticated();
      allow create, update, delete: if isSuperAdmin();
    }

    match /accessControl/{docId} {
      allow read: if isAuthenticated();
      allow write: if isSuperAdmin();
    }

    // =======================================
    //  Settings & Notices
    // =======================================
    match /settings/{settingId} {
      allow read: if true; // ওয়েবসাইট থিম বা লোগোর জন্য এটি পাবলিক থাকা প্রয়োজন
      allow write: if isAdminOrAbove();
    }

    match /notices/{noticeId} {
      allow read: if true; // নোটিশ বোর্ড সবার জন্য উন্মুক্ত
      allow create, update, delete: if isAdminOrAbove();
    }

    // =======================================
    //  Access Requests
    // =======================================
    match /access_requests/{requestId} {
      allow create: if true;
      allow read, update, delete: if isAdminOrAbove();
    }

    // =======================================
    //  Catch-All: Deny everything else
    // =======================================
    match /{document=**} {
      allow read, write: if false;
    }
  }
}