ERP Architecture & System Flow

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    
    // Validate contacts submissions
    match /contacts/{contactId} {
      allow create: if request.resource.data.phone != null;
      allow read, update, delete: if false; // Admin-only via server SDK
    }

    // Role-based student records permission
    match /students/{studentId} {
      allow read: if request.auth != null;
      allow write: if request.auth.token.role == 'admin';
    }

    // Term gradebooks: Teachers can write, Students can only read
    match /grades/{gradeId} {
      allow read: if request.auth != null;
      allow write: if request.auth.token.role == 'teacher' 
                   || request.auth.token.role == 'admin';
    }
  }
}