storage.rules

rules_version = '2';

// Cloud Storage rules for geekcollab-tsc.
//
// Path shape:
//   uploads/{uid}/{allPaths=**}   — post + comment attachments (25 MB max)
//   avatars/{uid}/{filename}      — profile pictures (5 MB max, images only)
//
// The uid in the path is always the *uploader*, enforced against request.auth.uid.
// That means a signed-in user can only write to their own subtree — no way to
// impersonate someone else's storage namespace. Everyone signed in can read
// (posts and profiles are behind the same auth wall as the rest of the app).
//
// The download URLs Firebase Storage returns include a token; even if someone
// were to guess a path, they can't fetch without that token. We store the
// tokenised download URL on the post/comment/users doc.

service firebase.storage {
  match /b/{bucket}/o {

    // Attachments for posts and comments.
    match /uploads/{uid}/{allPaths=**} {
      allow read: if request.auth != null;
      allow write: if request.auth != null
        && request.auth.uid == uid
        && request.resource.size < 25 * 1024 * 1024
        && (
             request.resource.contentType.matches('image/(png|jpe?g|gif|webp)')
          || request.resource.contentType == 'application/pdf'
          || request.resource.contentType == 'application/vnd.openxmlformats-officedocument.presentationml.presentation'
        );
      allow delete: if request.auth != null && request.auth.uid == uid;
    }

    // Profile avatars — image only, tighter size cap.
    match /avatars/{uid}/{filename} {
      allow read: if request.auth != null;
      allow write: if request.auth != null
        && request.auth.uid == uid
        && request.resource.size < 5 * 1024 * 1024
        && request.resource.contentType.matches('image/(png|jpe?g|webp)');
      allow delete: if request.auth != null && request.auth.uid == uid;
    }
  }
}