firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    function signedIn() {
      return request.auth != null;
    }

    function currentUser() {
      return get(/databases/$(database)/documents/users/$(request.auth.uid));
    }

    function isSuperAdmin() {
      return signedIn() &&
        currentUser().data.accessLevel == 0;
    }

    function roleFor(study) {
      return signedIn() &&
        study.studyRoleMap is map &&
        request.auth.uid in study.studyRoleMap
          ? study.studyRoleMap[request.auth.uid]
          : null;
    }

    function isOwner(study) {
      return signedIn() &&
        study.testAdmin.userDocId == request.auth.uid;
    }

    function isAdmin(study) {
      return isSuperAdmin() || isOwner(study) || roleFor(study) == 0;
    }

    function canReadStudy(study) {
      let role = roleFor(study);
      let type = study.get('testType', '');
      return signedIn() && (study.get('isPublic', false) == true ||
        isAdmin(study) || role == 4 ||
        (type == 'USER' && role in [3, 5]) ||
        (type == 'FOCUS_GROUP' && role in [1, 3]) ||
        (type in ['HEURISTIC', 'CARD_SORTING'] && role in [1, 2]));
    }

    function isSessionMember(session) {
      let email = request.auth.token.get('email', '');
      return signedIn() && (
        request.auth.uid in session.get('staffIds', []) ||
        request.auth.uid in session.get('participantIds', []) ||
        (email != '' && email in session.get('staffEmails', [])) ||
        (email != '' && email in session.get('participantEmails', []))
      );
    }

    function isStudySessionAdmin(studyId) {
      return signedIn() && isAdmin(
        get(/databases/$(database)/documents/tests/$(studyId)).data
      );
    }

    function canViewLogs(study) {
      return isAdmin(study);
    }

    match /users/{userId} {
      allow create: if signedIn() &&
        request.auth.uid == userId &&
        request.resource.data.accessLevel == 1;
      allow read: if signedIn();
      allow update: if isSuperAdmin() || (
        signedIn() &&
        request.resource.data.accessLevel == resource.data.accessLevel
      );
      allow delete: if isSuperAdmin() ||
        (signedIn() && request.auth.uid == userId);

      match /notifications/{notificationId} {
        allow read, write, delete: if signedIn()
      }
    }

    match /tests/{studyId} {
      allow create: if signedIn() &&
        request.resource.data.testAdmin.userDocId == request.auth.uid &&
        request.resource.data.studyRoleMap is map;
      allow read: if canReadStudy(resource.data);
      // RBAC changes and study edits go through trusted callable operations.
      // In particular, a client must not be able to promote itself by editing
      // studyRoleMap, even if it currently has a Manager/Admin role.
      allow update: if false;
      allow delete: if isAdmin(resource.data);

      match /sessions/{sessionId} {
        // Check the session-scoped grant first. Collection-group queries by
        // invited attendees must not need a read of the parent study, which
        // those attendees may intentionally be unable to read directly.
        allow read: if isSessionMember(resource.data) ||
          isStudySessionAdmin(studyId);
        allow create, update, delete: if isStudySessionAdmin(studyId);
      }

      match /participants/{participantId} {
        allow read, write: if signedIn();
      }

      match /auditTrail/{eventId} {
        allow read: if signedIn() &&
          get(/databases/$(database)/documents/tests/$(studyId))
            .data.testAdmin.userDocId == request.auth.uid;
        allow write: if false;
      }

      match /logs/{logId} {
        allow read: if canViewLogs(
          get(/databases/$(database)/documents/tests/$(studyId)).data
        );
        allow write: if false;
      }

      match /logBatches/{batchId} {
        allow read, write: if false;
      }

      match /loggingMeta/{metadataId} {
        allow read, write: if false;
      }

      match /studySessions/{sessionId} {
        allow read: if canViewLogs(
          get(/databases/$(database)/documents/tests/$(studyId)).data
        );
        allow write: if false;
      }

      match /participants/{participantId} {
        allow read: if signedIn();
      }
    }

    match /answers/{answerId} {
      function answerStudy() {
        return get(
          /databases/$(database)/documents/tests/$(resource.data.studyId)
        ).data;
      }

      function answerRoleCanRead(study) {
        let role = roleFor(study);
        let type = study.get('testType', '');
        return isAdmin(study) || role == 4 ||
          (type == 'USER' && role == 3) ||
          (type == 'FOCUS_GROUP' && role == 3) ||
          (type in ['HEURISTIC', 'CARD_SORTING'] && role in [1, 2]);
      }

      function participantAnswerChanged(field) {
        let before = resource.data.get(field, {});
        let after = request.resource.data.get(field, {});
        let oldEntry = before.get(request.auth.uid, {});
        return after is map && before is map &&
          after.diff(before).affectedKeys().hasOnly([request.auth.uid]) &&
          oldEntry.get('submitted', false) != true;
      }

      function canUpdateAnswerData() {
        let study = answerStudy();
        let role = roleFor(study);
        let changed = request.resource.data.diff(resource.data).affectedKeys();
        return signedIn() && (
          (changed.hasOnly(['sessions', 'themes']) && isAdmin(study)) ||
          (changed.hasOnly(['taskAnswers']) &&
            ((study.get('testType', '') == 'USER' && role == 5 &&
                participantAnswerChanged('taskAnswers')) ||
              (study.get('testType', '') == 'USER' &&
                study.get('subType', '') == 'USER_MODERATED' && role == 3 &&
                participantAnswerChanged('taskAnswers')))) ||
          (changed.hasOnly(['heuristicAnswers']) &&
            (study.get('testType', '') in ['HEURISTIC', 'CARD_SORTING']) &&
            role == 1 && participantAnswerChanged('heuristicAnswers')) ||
          (changed.hasOnly(['cardSortingAnswers']) &&
            study.get('testType', '') == 'CARD_SORTING' && role == 1 &&
            participantAnswerChanged('cardSortingAnswers')) ||
          (changed.hasOnly(['studyId']) && resource.data.studyId == null &&
            request.resource.data.studyId is string &&
            exists(/databases/$(database)/documents/tests/$(request.resource.data.studyId)) &&
            isAdmin(get(/databases/$(database)/documents/tests/$(request.resource.data.studyId)).data))
        );
      }

      allow create: if signedIn() &&
        request.resource.data.createdBy == request.auth.uid &&
        request.resource.data.studyId == null;
      allow read: if signedIn() && answerRoleCanRead(answerStudy());
      allow update: if canUpdateAnswerData();
      allow delete: if (
        signedIn() &&
        resource.data.studyId == null &&
        resource.data.createdBy == request.auth.uid
      ) || isAdmin(answerStudy());

       match /analytics/{analyticsId} {
          allow read: if true;
        }
    }

    // Existing non-study modules retain authenticated access. Their
    // collection-specific authorization is outside the study RBAC policy.
    match /templates/{document=**} {
      allow read, write: if signedIn();
    }
    match /assessments/{document=**} {
      allow read, write: if signedIn();
    }
    match /report/{document=**} {
      allow read, write: if signedIn();
    }
    match /audioSentiment/{document=**} {
      allow read, write: if signedIn();
    }
    match /sentiment/{document=**} {
      allow read, write: if signedIn();
    }
    match /transcriptions/{document=**} {
      allow read, write: if signedIn();
    }
    match /calibrations/{document=**} {
      allow read, write: if signedIn();
    }
    match /invites/{inviteId} {
      allow write: if signedIn();
      allow read: if true;
    }
    match /agents/{agentId} {
      allow read, write: if signedIn();
    }
    match /settings/{settingId} {
      allow read: if signedIn();
    }
    match /{path=**}/sessions/{sessionId} {
      allow read: if isSessionMember(resource.data);
      allow write: if false;
    }
  }
}