storage.rules

rules_version = '2';

// Craft rules based on data in your Firestore database
// allow write: if firestore.get(
//    /databases/(default)/documents/users/$(request.auth.uid)).data.isAdmin;
service firebase.storage {
  match /b/{bucket}/o {
    // Helper functions
    function isAuthenticated() {
      return request.auth != null;
    }

    // For now, allow any authenticated user to upload assignments
    // In a production environment, you would need to implement custom claims
    // or use a different approach to verify teacher status
    function isTeacher() {
      return isAuthenticated();
    }

    function isUserInChat(chatId) {
      return isAuthenticated() && 
             exists(/databases/$(database)/documents/chats/$(chatId)) &&
             request.auth.uid in get(/databases/$(database)/documents/chats/$(chatId)).data.participants;
    }

    // Profile pictures - specific rules
    match /profile-pictures/{userId}/{allPaths=**} {
      allow read: if isAuthenticated();  // Any authenticated user can view profile pictures
      allow write: if isAuthenticated() && request.auth.uid == userId;  // Only user can upload their own picture
    }

    // Chat attachments and files
    match /chat/{chatId}/{allPaths=**} {
      allow read: if isUserInChat(chatId);
      allow write: if isUserInChat(chatId) && 
                   request.resource.size < 10 * 1024 * 1024 &&  // 10MB file size limit
                   request.resource.contentType.matches('image/.*|video/.*|application/pdf');  // Restrict file types
    }

    // Assignment files
    match /assignments/{teacherId}/{allPaths=**} {
      allow read: if isAuthenticated();
      allow write: if isAuthenticated() && 
                   request.auth.uid == teacherId && // Users can only upload to their own folder
                   request.resource.size < 20 * 1024 * 1024;  // 20MB file size limit
      allow delete: if isAuthenticated() && request.auth.uid == teacherId; // Users can delete their own files
    }

    // Announcement attachments
    match /announcements/{teacherId}/{fileName} {
      allow read: if isAuthenticated();  // Any authenticated user can read announcements
      allow write: if isAuthenticated() && 
                   request.auth.uid == teacherId && // Users can only write to their own folder
                   request.resource.size < 20 * 1024 * 1024 && // 20MB file size limit
                   request.resource.contentType.matches('image/.*|video/.*|application/pdf|application/msword|application/vnd.openxmlformats-officedocument.wordprocessingml.document'); // Restrict file types
      allow delete: if isAuthenticated() && request.auth.uid == teacherId; // Users can delete their own attachments
    }

    // Submission files - Updated rules
    match /submissions/{assignmentId}/{studentId}/{fileName} {
      allow read: if isAuthenticated() && (
        request.auth.uid == studentId // Students can read their own submissions
      );
      allow create, update: if isAuthenticated() && 
        request.auth.uid == studentId && // Students can only write to their own folder
        request.resource.size < 50 * 1024 * 1024; // 50MB file size limit
      allow delete: if isAuthenticated() && request.auth.uid == studentId; // Students can delete their own submissions
    }

    // Suggestions files
    match /suggestions/{userId}/{allPaths=**} {
      allow read: if isAuthenticated();
      allow write: if isAuthenticated() && 
                   request.auth.uid == userId && // Users can only write to their own folder
                   request.resource.size < 10 * 1024 * 1024 && // 10MB file size limit
                   request.resource.contentType.matches('image/.*|video/.*|application/pdf'); // Restrict file types
      allow delete: if isAuthenticated() && request.auth.uid == userId; // Users can delete their own suggestions
    }

    // Default rule - deny all other access
    match /{allPaths=**} {
      allow read: if isAuthenticated();
      allow write: if false;
    }
  }
}