firestore.rules.new

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    // Helper functions
    function isAuthenticated() {
      return request.auth != null;
    }
    
    function isAdmin() {
      return isAuthenticated() && 
        get(/databases/$(database)/documents/users/$(request.auth.uid)).data.role == 'admin';
    }
    
    function isAgent() {
      return isAuthenticated() && 
        get(/databases/$(database)/documents/users/$(request.auth.uid)).data.role in ['agent', 'admin'];
    }
    
    function isOwner(userId) {
      return isAuthenticated() && request.auth.uid == userId;
    }
    
    function hasValidFields(requiredFields) {
      return request.resource.data.keys().hasAll(requiredFields);
    }

    // Users collection
    match /users/{userId} {
      allow read: if isAuthenticated();
      allow create: if isAdmin();
      allow update: if isAdmin() || isOwner(userId);
      allow delete: if isAdmin();
    }

    // Chat sessions and messages
    match /chat_sessions/{sessionId} {
      allow read: if isAuthenticated() && (
        resource.data.userId == request.auth.uid || 
        isAgent()
      );
      allow create: if isAuthenticated();
      allow update: if isAuthenticated() && (
        resource.data.userId == request.auth.uid || 
        isAgent()
      );
      allow delete: if isAdmin();
    }

    match /chat_messages/{messageId} {
      allow read: if isAuthenticated() && (
        get(/databases/$(database)/documents/chat_sessions/$(resource.data.sessionId)).data.userId == request.auth.uid ||
        isAgent()
      );
      allow create: if isAuthenticated() && hasValidFields(['content', 'sessionId', 'timestamp', 'role']);
      allow update: if false;  // Messages should be immutable
      allow delete: if isAdmin();
    }

    // Tickets
    match /tickets/{ticketId} {
      allow read: if isAuthenticated() && (
        resource.data.userId == request.auth.uid || 
        isAgent()
      );
      allow create: if isAuthenticated() && hasValidFields(['title', 'description', 'priority', 'status']);
      allow update: if isAuthenticated() && (
        resource.data.userId == request.auth.uid || 
        isAgent()
      );
      allow delete: if isAdmin();
    }

    // Assets
    match /assets/{assetId} {
      allow read: if isAuthenticated();
      allow create: if isAgent() && hasValidFields(['name', 'type', 'status']);
      allow update: if isAgent();
      allow delete: if isAdmin();
    }

    // Knowledge Base Articles
    match /articles/{articleId} {
      allow read: if true;  // Public access for knowledge base
      allow create: if isAgent() && hasValidFields(['title', 'content', 'category']);
      allow update: if isAgent();
      allow delete: if isAdmin();
    }

    // Settings
    match /settings/{settingId} {
      allow read: if true;
      allow write: if isAdmin();
    }

    // Service Status
    match /services/{serviceId} {
      allow read: if true;
      allow write: if isAgent();
    }

    // Incidents
    match /incidents/{incidentId} {
      allow read: if true;
      allow write: if isAgent();
    }

    // Comments
    match /comments/{commentId} {
      allow read: if isAuthenticated();
      allow create: if isAuthenticated() && hasValidFields(['content', 'userId', 'timestamp']);
      allow update: if isAuthenticated() && resource.data.userId == request.auth.uid;
      allow delete: if isAdmin() || resource.data.userId == request.auth.uid;
    }

    // Notifications
    match /notifications/{notificationId} {
      allow read: if isAuthenticated() && resource.data.userId == request.auth.uid;
      allow create: if isAgent();
      allow update: if isAgent() || resource.data.userId == request.auth.uid;
      allow delete: if isAdmin() || resource.data.userId == request.auth.uid;
    }

    // User Settings
    match /userSettings/{userId} {
      allow read: if isAuthenticated() && (isOwner(userId) || isAdmin());
      allow write: if isAuthenticated() && (isOwner(userId) || isAdmin());
    }

    // Analytics
    match /analytics/{docId} {
      allow read: if isAgent();
      allow write: if isAgent();
    }
  }
}