# Realtime Database rules (purchases / distributors)

## Firebase project: arafstore-14938 (Console checklist)

Before rules deploy, confirm in [Firebase Console](https://console.firebase.google.com/project/arafstore-14938):

1. **Realtime Database** — created (US), URL matches `firebase-config.js`: `https://arafstore-14938-default-rtdb.firebaseio.com`
2. **Authentication** → Sign-in method → **Email/Password** enabled
3. **Authentication** → Settings → **Authorized domains** — add production host + `localhost` for local dev
4. **Service account** — `api/firebase-service-account.local.json` on server (see `deploy/firebase-server-files/README-DEPLOY.txt`)

Fresh projects: you may use **test mode** rules temporarily for setup, then publish [`database.rules.json`](database.rules.json).

---

This repo includes [`database.rules.json`](database.rules.json) with **`purchases`** and **`distributors`** read/write rules for shop admins (same pattern as `orders` / `admins`).

## Apply the rules

**Option A — Firebase Console**  
Realtime Database → **Rules** → paste the contents of `database.rules.json` → **Publish**.

**Option B — Firebase CLI** (from this folder, with the correct project selected)

```bash
firebase deploy --only database
```

If you use the CLI, run `firebase login` and `firebase use <your-project-id>` first (or add a `.firebaserc` with your project).

Until rules are published to your Firebase project, **Add Purchase** and **Purchase List** may stay on loading or show load errors for non-owner admin accounts.

## RTDB indexes (accounting + dashboard summary)

Publish rules that include the following **in addition** to your normal shop-admin read/write logic (paths are under `clients/{clientId}/…`):

1. **`fundTransfers` index** — required for `orderByChild('createdAtMs')` queries used by `accounting-pages.js` (non-recon routes). Add:

   ```json
   "fundTransfers": {
     ".indexOn": ["createdAtMs"]
   }
   ```

2. **`dashboardSummary/latest`** — optional small KPI snapshot written from the dashboard home panel. Grant admin-authenticated read/write consistent with how you secure `orders` / `siteSettings` (see `database.rules.example.json` for a minimal placeholder).

3. **`dashboardAnalytics/latest`** — compact chart/KPI blob from `dashboard-analytics-client.js` (debounced from dashboard home).

4. **`inventorySummary/latest`** — product/category/low-stock counts from `inventory-summary-client.js` (inventory page).

5. **`posTodaySummary/{yyyy-mm-dd}`** — POS day rollup counters (`posOrderCount`, `posGrossTotalCents`) incremented on checkout; read for POS header when present.

6. **`orders` indexes** — if you query by `createdAt` / `createdAtMs`, add `.indexOn` under `orders` (see example file).

7. **`visitors` index** — `orderByChild('lastActive')` (dashboard home + spy-limited modes) needs `.indexOn: ["lastActive"]` under `visitors`.

## Tenant admin invites (dashboard Profile → Admin team)

Server-side PHP endpoints under `api/tenant-admin-*.php` write `clients/{clientId}/admins/{uid}` using the **service account** (see [`FIREBASE_RULES_ADMIN_TEAM.md`](FIREBASE_RULES_ADMIN_TEAM.md)). Client RTDB rules that only allow `auth.uid === $uid` for admin writes are compatible because end users do not write other users’ admin nodes directly.
