storage.rules

rules_version = '2';
service firebase.storage {
  match /b/{bucket}/o {
    function isOwner(uid) {
      return request.auth != null && request.auth.uid == uid;
    }
    function isImage() {
      return request.resource != null &&
             request.resource.contentType.matches('image/.*');
    }

    // ---------- User Avatars ----------
    match /users/{uid}/avatars/{file} {
      allow read: if true; // public read avatars
      allow write: if isOwner(uid) && isImage() && request.resource.size < 10 * 1024 * 1024; // 10 MB
    }

    // ---------- Project Images ----------
    match /users/{uid}/projects/{file} {
      allow read: if true;
      allow write: if isOwner(uid) && isImage() && request.resource.size < 10 * 1024 * 1024; // 10 MB
    }

    // ---------- Project Log Images ----------
    match /users/{uid}/projects/{projectId}/logs/{file} {
      allow read: if true;
      allow write: if isOwner(uid) && isImage() && request.resource.size < 10 * 1024 * 1024; // 10 MB
    }

    // ---------- Default Deny ----------
    match /{allPaths=**} {
      allow read, write: if false;
    }
  }
}