إعداد Firebase السحابي

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {

    function getUserData() {
      return get(/databases/$(database)/documents/users/$(request.auth.uid)).data;
    }
    function isAuth() { return request.auth != null; }
    function belongsToCompany(companyId) {
      return isAuth() && getUserData().companyId == companyId;
    }
    function isAdminOf(companyId) {
      return belongsToCompany(companyId) && getUserData().role == 'admin';
    }

    match /users/{userId} {
      allow read: if isAuth() && request.auth.uid == userId;
      allow create: if isAuth() && request.auth.uid == userId;
      allow update: if isAuth() && request.auth.uid == userId;
    }

    match /companies/{companyId} {
      allow read:  if belongsToCompany(companyId);
      allow write: if isAdminOf(companyId);

      match /invoices/{id} {
        allow read, create, update: if belongsToCompany(companyId);
        allow delete: if isAdminOf(companyId);
      }
      match /stock/{id}    { allow read: if belongsToCompany(companyId); allow write: if isAdminOf(companyId); }
      match /fleet/{id}    { allow read: if belongsToCompany(companyId); allow write: if isAdminOf(companyId); }
      match /sellers/{id}  { allow read: if belongsToCompany(companyId); allow write: if isAdminOf(companyId); }
      match /expenses/{id} { allow read: if belongsToCompany(companyId); allow write: if isAdminOf(companyId); }
    }

    match /{document=**} { allow read, write: if false; }
  }
}