storage.rules

rules_version = '2';

service firebase.storage {
  match /b/{bucket}/o {
    
    // ─────────────────────────────────────────────
    // HELPER FUNCTIONS
    // ─────────────────────────────────────────────
    
    function isAuthenticated() {
      return request.auth != null;
    }
    
    function isAdmin() {
      return isAuthenticated() && 
        firestore.get(/databases/(default)/documents/users/$(request.auth.uid)).data.role == 'admin';
    }

    // ─────────────────────────────────────────────
    // FOLDER RULES
    // ─────────────────────────────────────────────

    // Products & Collections: Publicly readable, Admin writeable
    match /products/{allPaths=**} {
      allow read: if true;
      allow write: if isAdmin();
    }
    
    match /collections/{allPaths=**} {
      allow read: if true;
      allow write: if isAdmin();
    }
    
    match /general/{allPaths=**} {
      allow read: if true;
      allow write: if isAdmin();
    }

    match /blog/{allPaths=**} {
      allow read: if true;
      allow write: if isAdmin();
    }

    // Digital Assets: Restricted to Admin write and read.
    // Client access is mediated via the secure Next.js /api/downloads endpoint
    // which verifies ownership in Firestore before streaming the file.
    match /digital-assets/{assetId} {
      allow read, write: if isAdmin();
    }

    // Default deny
    match /{allPaths=**} {
      allow read, write: if false;
    }
  }
}