firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    function isAuthorizedUser() {
      return request.auth != null && request.auth.token.email.matches('.*@example[.]com');
      // IMPORTANT: replace example.com with your deployed ALLOWED_AUTH_DOMAIN before deploying rules.
    }

    function userDepartment() {
      let userPath = /databases/$(database)/documents/users/$(request.auth.uid);
      return exists(userPath) &&
        get(userPath).data.keys().hasAny(['department'])
          ? get(userPath).data.department
          : null;
    }

    function hasLegacyAiConfigSecretMaterial(data) {
      return data != null &&
        ('aiConfig' in data) &&
        data.aiConfig is map &&
        (
          ('apiKey' in data.aiConfig) ||
          ('apiKeyEnc' in data.aiConfig) ||
          ('credentialEnc' in data.aiConfig)
        );
    }

    // Dashboards collection
    match /dashboards/{dashboardId} {
      allow read: if isAuthorizedUser() && (
        (('createdBy' in resource.data) && request.auth.uid == resource.data.createdBy) ||
        (('visibility' in resource.data) && resource.data.visibility == "team") ||
        (('allowedEmails' in resource.data) && resource.data.allowedEmails is list && resource.data.allowedEmails.hasAny([request.auth.token.email])) ||
        (
          ('allowedDepartments' in resource.data) &&
          resource.data.allowedDepartments is list &&
          userDepartment() != null &&
          resource.data.allowedDepartments.hasAny([userDepartment()])
        )
      );
      // Dashboard creation is server-only (Admin SDK via /api/upload)
      allow create: if false;
      // Only the dashboard owner can update (ownership fields protected)
      allow update: if isAuthorizedUser() && request.auth.uid == resource.data.createdBy
        && !request.resource.data.diff(resource.data).affectedKeys()
            .hasAny(['createdBy', 'createdByEmail', 'createdByName']);
      // Only the dashboard owner can delete
      allow delete: if isAuthorizedUser() && request.auth.uid == resource.data.createdBy;

      // Version history — server-only (Admin SDK bypasses rules)
      // API routes handle owner-only access checks
      match /versions/{versionId} {
        allow read: if false;
        allow write: if false;
      }

      // View analytics events — server-only (Admin SDK bypasses rules)
      match /views/{viewId} {
        allow read: if false;
        allow write: if false;
      }

      // Embed tokens — server-only (Admin SDK bypasses rules)
      match /embedTokens/{tokenId} {
        allow read: if false;
        allow write: if false;
      }
    }

    // Users collection — all access requires authorized email domain
    match /users/{userId} {
      allow read: if isAuthorizedUser() && request.auth.uid == userId
        && (resource == null || !hasLegacyAiConfigSecretMaterial(resource.data));
      // Authorized users can create their own doc — role field BLOCKED (set server-side via Admin SDK)
      allow create: if isAuthorizedUser() && request.auth.uid == userId
        && !request.resource.data.keys().hasAny(['role', 'department', 'aiConfig']);
      // Updates cannot change role (admin-only via Admin SDK)
      allow update: if isAuthorizedUser() && request.auth.uid == userId
        && !request.resource.data.diff(resource.data).affectedKeys().hasAny(['role', 'department', 'aiConfig']);

      // Favorites subcollection — Authorized user can read/write their own
      match /favorites/{dashboardId} {
        allow read: if isAuthorizedUser() && request.auth.uid == userId;
        allow write: if isAuthorizedUser() && request.auth.uid == userId;
      }

      // Recently viewed subcollection — Authorized user can read/write their own
      match /recent/{dashboardId} {
        allow read: if isAuthorizedUser() && request.auth.uid == userId;
        allow write: if isAuthorizedUser() && request.auth.uid == userId;
      }

      // Viewed timestamps for "Updated" badge (Sprint 2) — Authorized user reads own, server writes
      match /viewed/{dashboardId} {
        allow read: if isAuthorizedUser() && request.auth.uid == userId;
      }

      // Personal folders — Authorized user can read/write their own
      match /folders/{folderId} {
        allow read: if isAuthorizedUser() && request.auth.uid == userId;
        allow write: if isAuthorizedUser() && request.auth.uid == userId;
      }
    }

    // Shared folders — server-only (Admin SDK bypasses rules)
    match /shared-folders/{folderId} {
      allow read: if false;
      allow write: if false;
    }

    // AI provider secrets — server-only (Admin SDK bypasses rules)
    match /ai_config_secrets/{userId} {
      allow read, write: if false;
    }

    // Slugs collection — server-only (Admin SDK bypasses rules)
    match /slugs/{slug} {
      allow read: if false;
      allow write: if false;
    }

    // Pending roles — Authorized users can read (for first login role assignment)
    match /pendingRoles/{docId} {
      allow read: if isAuthorizedUser();
      allow write: if false;
    }

    // Settings — Authorized users can read, server writes only
    match /settings/{docId} {
      allow read: if isAuthorizedUser();
      allow write: if false;
    }

    // App prompts — server-only (Admin SDK bypasses rules)
    // All access goes through /api/admin/prompts with verifySuperAdmin
    match /app_prompts/{promptKey} {
      allow read: if false;
      allow write: if false;

      match /versions/{versionId} {
        allow read: if false;
        allow write: if false;
      }
    }

    // Fontes externas são acessíveis apenas no servidor. O Admin SDK ignora as regras.
    match /data_sources/{id} {
      allow read, write: if false;
    }
  }
}