rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    // Allow authenticated users to read/write their own data
    match /users/{userId} {
      allow read, write: if request.auth != null && request.auth.uid == userId;
    }

    // Allow public reading of answered prayers for testimony wall
    match /prayers/{prayerId} {
      allow read: if resource.data.answered == true;
      allow read, write: if request.auth != null && 
        resource.data.userId == request.auth.uid;
      allow create: if request.auth != null && 
        request.resource.data.userId == request.auth.uid;
    }

    // Allow authenticated users to read/write their own prayer templates
    match /prayerTemplates/{templateId} {
      allow read, write: if request.auth != null && 
        resource.data.userId == request.auth.uid;
      allow create: if request.auth != null && 
        request.resource.data.userId == request.auth.uid;
    }

    // Allow authenticated users to read/write their own prayer goals
    match /prayerGoals/{goalId} {
      allow read, write: if request.auth != null && 
        resource.data.userId == request.auth.uid;
      allow create: if request.auth != null && 
        request.resource.data.userId == request.auth.uid;
    }

    // Allow authenticated users to read/write their own email templates
    match /emailTemplates/{templateId} {
      allow read, write: if request.auth != null && 
        resource.data.userId == request.auth.uid;
      allow create: if request.auth != null && 
        request.resource.data.userId == request.auth.uid;
    }

    // Allow server-side API access for scheduled emails (no auth required for GET)
    match /prayers {
      allow read: if true;
    }

    // Allow server-side API access for scheduled emails
    match /users {
      allow read: if true;
    }

    // Allow server-side API access to config (for SMTP settings)
    match /config/{configId} {
      allow read: if true;
      allow write: if request.auth != null;
    }

    // Allow authenticated users to read/write shared prayers
    match /sharedPrayers/{prayerId} {
      allow read: if true; // Anyone can read shared prayers
      allow create: if request.auth != null; // Only authenticated users can share
      allow update: if request.auth != null && 
        request.auth.uid == resource.data.userId; // Only the original sharer can update
      allow delete: if request.auth != null && 
        exists(/databases/$(database)/documents/config/admin) &&
        request.auth.token.email in 
        get(/databases/$(database)/documents/config/admin).data.adminEmails; // Only admins can delete
    }
  }
}