storage.rules

rules_version = '2';

service firebase.storage {
  match /b/{bucket}/o {

    // Helper function to check if user is authenticated
    function isAuthenticated() {
      return request.auth != null;
    }

    // User profile images - users can only access their own folder
    match /users/{userId}/{allPaths=**} {
      allow read: if isAuthenticated();
      allow write: if isAuthenticated() && request.auth.uid == userId;
    }

    // Public uploads folder (authenticated users only)
    match /uploads/{allPaths=**} {
      allow read: if true;
      allow write: if isAuthenticated()
                   && request.resource.size < 5 * 1024 * 1024 // Max 5MB
                   && request.resource.contentType.matches('image/.*');
    }

    // Default: Deny all access
    match /{allPaths=**} {
      allow read, write: if false;
    }
  }
}