rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    
    // ============================================
    // COLECCIONES PRINCIPALES EXISTENTES
    // ============================================
    
    match /discounts/{discountId} {
      allow read: if true;
      allow write: if request.auth != null;
    }
    
    match /freeAccounts/{accountId} {
      allow read: if true;
      allow create: if true;
      allow update: if request.auth != null;
      allow delete: if request.auth != null;
    }
    
    match /users/{userId} {
      allow read: if request.auth != null;
      allow create: if true;
      allow write: if request.auth != null;
    }
    
    match /payments/{paymentId} {
      allow read: if request.auth != null;
      allow create: if request.auth != null;
      allow update: if request.auth != null;
      allow delete: if false;
    }
    
    match /coordinators/{coordinatorId} {
      allow read: if request.auth != null;
      allow write: if request.auth != null;
    }
    
    match /coordinatorFolios/{folioId} {
      allow read: if true;
      allow create: if true;
      allow update: if request.auth != null;
      allow delete: if request.auth != null;
    }
    
    match /students/{studentId} {
      allow read: if request.auth != null;
      allow write: if request.auth != null;
    }
    
    match /tutorFolios/{folioId} {
      allow read: if true;
      allow create: if true;
      allow update: if request.auth != null;
      allow delete: if request.auth != null;
    }
    
    match /tutors/{tutorId} {
      allow read: if true;
      allow write: if request.auth != null;
    }
    
    match /teacherEvaluations/{evaluationId} {
      allow read: if true;
      allow create: if true;
      allow update: if true;
      allow delete: if request.auth != null;
    }
    
    match /public/{document=**} {
      allow read: if true;
      allow write: if request.auth != null;
    }
    
    match /config/{configId} {
      allow read: if true;
      allow write: if request.auth != null;
    }
    
    // ============================================
    // NUEVAS COLECCIONES PARA SISTEMA COMPLETO
    // ============================================
    
    // Transferencias pendientes de aprobación
    match /pendingTransfers/{transferId} {
      allow read: if true;  // Admin y usuarios pueden ver
      allow create: if true;  // Cualquiera puede crear (usuarios enviando comprobantes)
      allow update: if request.auth != null;  // Solo admin puede aprobar/rechazar
      allow delete: if request.auth != null;  // Solo admin puede eliminar
    }
    
    // Progreso de estudiantes en aulas
    match /studentProgress/{progressId} {
      allow read: if true;  // Estudiantes pueden ver su progreso
      allow create: if true;  // Estudiantes pueden crear su progreso
      allow update: if true;  // Estudiantes pueden actualizar marcadores
      allow delete: if request.auth != null;  // Solo admin puede eliminar
    }
    
    // Registro de emails enviados (logs)
    match /emailLogs/{logId} {
      allow read: if request.auth != null;  // Solo admin puede ver logs
      allow create: if true;  // Sistema puede crear logs automáticamente
      allow update: if request.auth != null;  // Solo admin puede actualizar
      allow delete: if request.auth != null;  // Solo admin puede eliminar
    }
    
    // ============================================
    // REGLA POR DEFECTO - DENEGAR TODO LO DEMÁS
    // ============================================
    
    match /{document=**} {
      allow read: if false;
      allow write: if false;
    }
  }
}