Your Health Deserves Better Oil

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {

    // An admin is a UID listed in /admins — NOT merely "someone logged in".
    // Customers can log in now, so request.auth != null is no longer enough.
    function isAdmin() {
      return request.auth != null
        && exists(/databases/$(database)/documents/admins/$(request.auth.uid));
    }
    function isOwner(uid) { return request.auth != null && request.auth.uid == uid; }

    match /admins/{uid} {
      allow read: if isOwner(uid) || isAdmin();
      allow write: if false;          // add admins by hand in the Firebase console
    }

    match /products/{d} {
      allow read: if true;
      allow create, delete: if isAdmin();
      // admin edits anything; anyone may ONLY lower qty (stock after a sale)
      allow update: if isAdmin()
        || (request.resource.data.diff(resource.data).affectedKeys().hasOnly(['qty'])
            && request.resource.data.qty is int
            && request.resource.data.qty >= 0
            && request.resource.data.qty < resource.data.qty);
    }

    match /combos/{d}   { allow read: if true;  allow write: if isAdmin(); }
    match /gifts/{d}    { allow read: if true;  allow write: if isAdmin(); }
    match /settings/{d} { allow read: if true;  allow write: if isAdmin(); }

    // A customer reads only their own profile.
    match /users/{uid} {
      allow read, write: if isOwner(uid);
      allow read: if isAdmin();
    }

    // Orders: anyone may place one. A signed-in customer may read their own.
    // Only an admin may read everyone's or change them.
    match /orders/{d} {
      allow create: if true;
      allow read: if isAdmin()
        || (request.auth != null && resource.data.uid == request.auth.uid);
      allow update, delete: if isAdmin();
    }

    match /inquiries/{d} {
      allow create: if true;
      allow read, update, delete: if isAdmin();
    }
  }
}