rules_version = '2';

service firebase.storage {
  match /b/{bucket}/o {
    function isSignedIn() { return request.auth != null; }
    function isDbAdmin() {
      return isSignedIn() && firestore.get(/databases/(default)/documents/users/$(request.auth.uid)).data.isAdmin == true;
    }

    match /testimonials/{userId}/{fileName} {
      allow read: if true;
      allow create, update: if isSignedIn() && (request.auth.uid == userId || isDbAdmin())
                   && request.resource.size < 5 * 1024 * 1024 // 5MB limit
                   && request.resource.contentType.matches('image/.*');
      allow delete: if isSignedIn() && (request.auth.uid == userId || isDbAdmin());
    }

    match /scans/{userId}/{fileName} {
      allow read: if isSignedIn() && (request.auth.uid == userId || isDbAdmin());
      allow create, update: if isSignedIn() && (request.auth.uid == userId || isDbAdmin())
                   && request.resource.size < 5 * 1024 * 1024 // 5MB limit
                   && request.resource.contentType.matches('image/.*');
      allow delete: if isSignedIn() && (request.auth.uid == userId || isDbAdmin());
    }
  }
}