storage.rules

rules_version = '2';

// Firebase Storage Security Rules for TaloFix
// Images are uploaded via Cloud Functions, so no direct create/update rules needed
service firebase.storage {
  match /b/{bucket}/o {
    
    // Helper function to check if user is authenticated
    function isAuthenticated() {
      return request.auth != null;
    }
    
    // ========== FAULT REPORT IMAGES ==========
    // Path: /faultReports/{reportId}/image_{index}.{ext}
    // Upload is handled by Cloud Function (uploadFaultReportImage)
    match /faultReports/{reportId}/{imageFile} {
      // Only allow reading images (upload via Cloud Function only)
      allow read: if isAuthenticated();
      
      // No direct write access - uploads go through Cloud Function
      allow write: if false;
    }
    
    // ========== USER PROFILE IMAGES (future use) ==========
    match /users/{userId}/{imageFile} {
      // For now, allow authenticated users to manage their own profile images
      allow read: if isAuthenticated();
      allow write: if isAuthenticated() && request.auth.uid == userId;
    }
    
    // ========== ANNOUNCEMENT ATTACHMENTS ==========
    // Path: /announcements/{housingCompanyId}/{attachmentId}/file
    // Upload is handled by Cloud Function (uploadAnnouncementAttachment)
    // Updates/deletions handled by Cloud Function (updateAnnouncementWithAttachments, deleteAnnouncement)
    match /announcements/{housingCompanyId}/{attachmentFolder}/{allFiles=**} {
      allow read: if isAuthenticated();
      // No direct write access - uploads/deletes go through Cloud Functions
      allow write: if false;
    }
    
    // ========== LEGACY ANNOUNCEMENT IMAGES ==========
    // Path: /announcements/{housingCompanyId}/{fileName}_{timestamp}.{ext}
    // Upload is handled by Cloud Function (uploadAnnouncementFile - DEPRECATED)
    match /announcements/{housingCompanyId}/{imageFile} {
      allow read: if isAuthenticated();
      // No direct write access - uploads go through Cloud Function
      allow write: if false;
    }
    
    // Deny all other paths by default
    match /{allPaths=**} {
      allow read, write: if false;
    }
  }
}