storage.rules

rules_version = '2';
service firebase.storage {
  match /b/{bucket}/o {
    // Helper functions
    function isAuthenticated() {
      return request.auth != null;
    }

    function isManagerOrAdmin() {
      return isAuthenticated() && firestore.get(/databases/(default)/documents/users/$(request.auth.uid)).data.role in ['MANAGER', 'ADMINISTRATOR'];
    }

    // Optimized Big Data Structure (Hive Partitioning)
    // Structure: proofs/year=YYYY/month=MM/day=DD/filename.png
    
    // Allow listing/reading/creation of all proofs (recursive)
    // Simplified rule to allow arbitrary nesting depth which occurs in RouteEditor.tsx
    // Structure: proofs/city={cityName}/year={YYYY}/month={MM}/day={DD}/...
    match /proofs/{allPaths=**} {
      allow read: if isManagerOrAdmin();
      allow create: if isAuthenticated()
                   && request.resource.size < 5 * 1024 * 1024 // Max 5MB
                   && request.resource.contentType.matches('image/.*');
      allow update, delete: if isManagerOrAdmin();
    }


    
    // Backups (Admin Only)
    match /backups/{allPaths=**} {
      allow read, write: if isManagerOrAdmin();
    }

    // Default deny
    match /{allPaths=**} {
      allow read, write: if false;
    }
  }
}