storage.rules

rules_version = '2';
service firebase.storage {
  match /b/{bucket}/o {
    // Users can only access their own documents
    match /documents/{userId}/{allPaths=**} {
      allow read, write: if request.auth != null && request.auth.uid == userId;
    }
    
    // Profile pictures can be read by anyone but only written by the owner
    match /profile_pictures/{userId}/{fileName} {
      allow read: if true;
      allow write: if request.auth != null && request.auth.uid == userId;
    }
    
    // Public documents can be read by anyone
    match /public/{allPaths=**} {
      allow read: if true;
      allow write: if request.auth != null;
    }
    
    // Admin users can access all files
    match /{allPaths=**} {
      allow read, write: if request.auth != null && 
        firestore.get(/databases/(default)/documents/users/$(request.auth.uid)).data.role == 'admin';
    }
    
    // File size limit (10MB)
    match /{allPaths=**} {
      allow write: if request.resource.size < 10 * 1024 * 1024;
    }
    
    // File type restrictions
    match /{allPaths=**} {
      allow write: if request.resource.contentType.matches('application/pdf') ||
                      request.resource.contentType.matches('text/.*') ||
                      request.resource.contentType.matches('image/.*') ||
                      request.resource.contentType.matches('application/msword') ||
                      request.resource.contentType.matches('application/vnd.openxmlformats-officedocument.wordprocessingml.document') ||
                      request.resource.contentType.matches('application/vnd.ms-excel') ||
                      request.resource.contentType.matches('application/vnd.openxmlformats-officedocument.spreadsheetml.sheet') ||
                      request.resource.contentType.matches('application/vnd.ms-powerpoint') ||
                      request.resource.contentType.matches('application/vnd.openxmlformats-officedocument.presentationml.presentation');
    }
  }
}