firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    // Check if the user is authenticated
    function isAuthenticated() {
       return request.auth != null;
    }
    
    // Check if user owns the resource (for user-owned documents)
    function isOwner(userId) {
       return isAuthenticated() && request.auth.uid == userId;
    }
    
    function isAdmin() {
      return isAuthenticated() &&
        (get(/databases/$(database)/documents/users/$(request.auth.uid)).data.role == 'admin' ||
          (request.auth.token.email == "baha@bahasavage.com" && request.auth.token.email_verified == true));
    }

    match /users/{userId} {
      allow read: if isOwner(userId) || isAdmin();
      allow create: if isAuthenticated() && isOwner(userId);
      allow update: if isOwner(userId) || isAdmin();
    }

    match /properties/{propertyId} {
      allow read: if true;
      allow write: if isAdmin();
    }

    match /courses/{courseId} {
      allow read: if true;
      allow write: if isAdmin();
    }

    match /nonprofits/{nonprofitId} {
      allow read: if true;
      allow write: if isAdmin();
    }

    match /blogs/{blogId} {
      allow read: if true;
      allow write: if isAdmin();
    }

    match /social_posts/{postId} {
      allow read: if isAdmin();
      allow write: if isAdmin();
    }
  }
}