desartstudio95
175723475a
Refines Firestore and Storage rules to enforce stricter access controls for signals and user-uploaded files. Updates user data handling to ensure root administrator privileges are correctly applied and enforced. Organizes uploaded scan files into user-specific directories within storage.
27 lines
1.1 KiB
Plaintext
27 lines
1.1 KiB
Plaintext
rules_version = '2';
|
|
|
|
service firebase.storage {
|
|
match /b/{bucket}/o {
|
|
function isSignedIn() { return request.auth != null; }
|
|
function isDbAdmin() {
|
|
return isSignedIn() && firestore.get(/databases/(default)/documents/users/$(request.auth.uid)).data.isAdmin == true;
|
|
}
|
|
|
|
match /testimonials/{userId}/{fileName} {
|
|
allow read: if true;
|
|
allow create, update: if isSignedIn() && (request.auth.uid == userId || isDbAdmin())
|
|
&& request.resource.size < 5 * 1024 * 1024 // 5MB limit
|
|
&& request.resource.contentType.matches('image/.*');
|
|
allow delete: if isSignedIn() && (request.auth.uid == userId || isDbAdmin());
|
|
}
|
|
|
|
match /scans/{userId}/{fileName} {
|
|
allow read: if isSignedIn() && (request.auth.uid == userId || isDbAdmin());
|
|
allow create, update: if isSignedIn() && (request.auth.uid == userId || isDbAdmin())
|
|
&& request.resource.size < 5 * 1024 * 1024 // 5MB limit
|
|
&& request.resource.contentType.matches('image/.*');
|
|
allow delete: if isSignedIn() && (request.auth.uid == userId || isDbAdmin());
|
|
}
|
|
}
|
|
}
|