firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {

    function isSignedIn() {
      return request.auth != null;
    }

    function isAdmin() {
      return isSignedIn() && 
        exists(/databases/$(database)/documents/roles_admin/$(request.auth.uid)) &&
        get(/databases/$(database)/documents/roles_admin/$(request.auth.uid)).data.role == 'admin';
    }

    // Allow users to check their own admin role
    match /roles_admin/{userId} {
      allow read: if isSignedIn() && request.auth.uid == userId;
      allow write: if isAdmin(); // Only admins can modify roles
    }

    // Number Generator Rules
    match /availableNumbers/{numberId} {
      // Users can see unused stock OR their own assigned numbers
      allow read: if isSignedIn() && (
        resource.data.isUsed == false || 
        resource.data.assignedTo == request.auth.token.email || 
        isAdmin()
      );
      
      // Admin can populate/delete data
      allow create, delete: if isAdmin();
      
      // Users can only mark a number as used if it's currently free
      allow update: if isSignedIn() 
        && resource.data.isUsed == false 
        && request.resource.data.isUsed == true
        && (request.resource.data.assignedTo == request.auth.token.email || isAdmin());
    }

    match /userGenerationLimits/{userId} {
      allow read, write: if isSignedIn() && request.auth.uid == userId;
      allow read, write: if isAdmin();
    }

    // Employee History Rules
    match /employee_history/{docId} {
      allow read: if isSignedIn();
      allow create, update, delete: if isAdmin();
    }

    // Media Library Rules
    match /media_library/{id} {
      allow read: if true;
      allow write, delete: if isAdmin();
    }

    // BIOS & Boot Menu Keys Rules
    match /bios_keys/{keyId} {
      allow read: if true; // Publik, siapa saja bisa cari tombol
      allow create, update, delete: if isAdmin(); // Hanya bisa diisi/diubah Admin
    }

    // Audit logs
    match /audit_logs/{logId} {
      allow write: if isSignedIn();
      allow read: if isAdmin();
    }

    // Default deny
    match /{path=**} {
      allow read, write: if false;
    }
  }
}