firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    // Helper functions
    function isAuthenticated() {
      return request.auth != null;
    }
    
    function isOwner(userId) {
      return isAuthenticated() && request.auth.uid == userId;
    }
    
    function hasRole(role) {
      return isAuthenticated() && get(/databases/$(database)/documents/users/$(request.auth.uid)).data.role == role;
    }

    // Users collection
    match /users/{userId} {
      allow read: if isAuthenticated();
      allow create: if isAuthenticated() && request.resource.data.role == 'agent';
      allow update: if isOwner(userId) || hasRole('owner');
      allow delete: if hasRole('owner');
    }

    // Submissions collection
    match /submissions/{submissionId} {
      allow read: if isAuthenticated() && (
        isOwner(resource.data.agentId) || 
        hasRole('owner')
      );
      allow create: if isAuthenticated() && request.resource.data.agentId == request.auth.uid;
      allow update: if isAuthenticated() && (
        isOwner(resource.data.agentId) || 
        hasRole('owner')
      );
      allow delete: if hasRole('owner');
    }

    // Agencies collection
    match /agencies/{agencyId} {
      allow read: if isAuthenticated();
      allow write: if hasRole('owner');
    }
  }
}