storage.rules

rules_version = '2';
service firebase.storage {
  match /b/{bucket}/o {
    
    // Helper functions
    function isAuthenticated() {
      return request.auth != null;
    }
    
    function isOwner(userId) {
      return isAuthenticated() && request.auth.uid == userId;
    }
    
    function isValidResume() {
      return request.resource.size < 10 * 1024 * 1024 && // Max 10MB
        request.resource.contentType.matches('application/pdf|application/vnd.*|application/msword|text/plain');
    }
    
    // Resume uploads - users can only access their own files
    match /resumes/{userId}/{fileName} {
      allow read: if isOwner(userId);
      allow write: if isOwner(userId) && isValidResume();
      allow delete: if isOwner(userId);
    }
    
    // Profile pictures (if needed in future)
    match /profiles/{userId}/{fileName} {
      allow read: if true; // Public profile pictures
      allow write: if isOwner(userId) && 
        request.resource.size < 5 * 1024 * 1024 && // Max 5MB
        request.resource.contentType.matches('image/.*');
      allow delete: if isOwner(userId);
    }
    
    // Block all other paths
    match /{allPaths=**} {
      allow read, write: if false;
    }
  }
}