rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {

    function isAdmin() {
      return request.auth != null &&
        request.auth.token.email in [
          'admin@totv.com',
          'haedirasso@gmail.com'
        ];
    }
    function isAuth()  { return request.auth != null; }
    function isOwner(uid) {
      return isAuth() && request.auth.uid == uid;
    }

    // app_config — قراءة للجميع، كتابة للأدمن
    match /app_config/{doc} {
      allow read:  if true;
      allow write: if isAdmin();
    }

    // users/{uid} — النظام الجديد
    match /users/{uid} {
      allow read:   if isOwner(uid) || isAdmin();
      allow create: if isOwner(uid);
      allow update: if (isOwner(uid) &&
        !request.resource.data.diff(resource.data)
          .affectedKeys().hasAny(['status','role','is_admin',
            'subscription.plan','subscription.host',
            'subscription.username','subscription.password',
            'free_hours_per_day'])) ||
        isAdmin();
      allow delete: if isAdmin();
    }

    // orders — الطلبات (المستخدم يكتب، الأدمن يدير)
    match /orders/{orderId} {
      allow read:   if isAuth() &&
        (resource.data.uid == request.auth.uid || isAdmin());
      allow create: if isAuth() &&
        request.resource.data.uid == request.auth.uid;
      allow update, delete: if isAdmin();
    }

    // notifications — قراءة للكل
    match /notifications/{doc} {
      allow read:  if true;
      allow write: if isAdmin();
    }

    // servers — الأدمن فقط
    match /servers/{doc} {
      allow read:  if isAuth();
      allow write: if isAdmin();
    }

    // version_history — الأدمن فقط
    match /version_history/{doc} {
      allow read, write: if isAdmin();
    }

    // app_logs — المسجلون يكتبون، الأدمن يقرأ
    match /app_logs/{log} {
      allow create: if isAuth();
      allow read, update, delete: if isAdmin();
    }

    // catch-all
    match /{document=**} {
      allow read, write: if false;
    }
  }
}