storage.rules

rules_version = '2';
service firebase.storage {
  match /b/{bucket}/o {
    // Helper function to check if user is admin
    function isAdmin() {
      return request.auth != null && 
        firestore.get(/databases/(default)/documents/users/$(request.auth.uid)).data.role == 'admin';
    }

    // Images folder
    match /images/{allImages=**} {
      allow read: if true;  // Anyone can read images
      allow create: if request.auth != null && (
        // File size less than 5MB
        request.resource.size < 5 * 1024 * 1024 &&
        // Only allow image files
        request.resource.contentType.matches('image/.*')
      );
      allow update, delete: if request.auth != null && isAdmin();
    }

    // Product images
    match /products/{productId}/{imageFile} {
      allow read: if true;
      allow write: if request.auth != null && isAdmin();
    }

    // User uploads
    match /users/{userId}/{allFiles=**} {
      allow read: if true;
      allow write: if request.auth != null && (
        request.auth.uid == userId ||
        isAdmin()
      );
    }
  }
}