TourTipApp/storage.rules at develop · ahmetcemkaraca/TourTipApp · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
rules_version = '2';

service firebase.storage {
  match /b/{bucket}/o {
    // Helper functions
    function isAuthenticated() {
      return request.auth != null;
    }

    function isOwner(userId) {
      return isAuthenticated() && request.auth.uid == userId;
    }

    function isAdmin() {
      return isAuthenticated() &&
             firestore.get(/databases/(default)/documents/users/$(request.auth.uid)).data.role == 'admin';
    }

    function isProvider() {
      return isAuthenticated() &&
             firestore.get(/databases/(default)/documents/users/$(request.auth.uid)).data.role in ['provider', 'admin'];
    }

    function isModerator() {
      return isAuthenticated() &&
             firestore.get(/databases/(default)/documents/users/$(request.auth.uid)).data.role in ['moderator', 'admin'];
    }

    function isValidImageFile() {
      return resource.contentType.matches('image/.*');
    }

    function isValidFileSize(maxSizeInMB) {
      return resource.size <= maxSizeInMB * 1024 * 1024;
    }

    function isValidFileName() {
      return resource.name.matches('[a-zA-Z0-9._-]+');
    }

    // User profile images
    match /users/{userId}/profile/{fileName} {
      allow read: if true; // Public read for profile images
      allow write: if isAuthenticated() &&
                      isOwner(userId) &&
                      isValidImageFile() &&
                      isValidFileSize(5) &&
                      isValidFileName();
      allow delete: if isAuthenticated() && (isOwner(userId) || isAdmin());
    }

    // Tour images
    match /tours/{tourId}/images/{fileName} {
      allow read: if true; // Public read for tour images
      allow write: if isProvider() &&
                      isValidImageFile() &&
                      isValidFileSize(10) &&
                      isValidFileName();
      allow delete: if isProvider() || isAdmin();
    }

    // Restaurant images
    match /restaurants/{restaurantId}/images/{fileName} {
      allow read: if true; // Public read for restaurant images
      allow write: if isProvider() &&
                      isValidImageFile() &&
                      isValidFileSize(10) &&
                      isValidFileName();
      allow delete: if isProvider() || isAdmin();
    }

    // Shop images
    match /shops/{shopId}/images/{fileName} {
      allow read: if true; // Public read for shop images
      allow write: if isProvider() &&
                      isValidImageFile() &&
                      isValidFileSize(10) &&
                      isValidFileName();
      allow delete: if isProvider() || isAdmin();
    }

    // CMS media files
    match /cms/media/{fileName} {
      allow read: if true; // Public read for CMS media
      allow write: if isModerator() &&
                      (isValidImageFile() ||
                       resource.contentType.matches('video/.*') ||
                       resource.contentType.matches('audio/.*') ||
                       resource.contentType == 'application/pdf') &&
                      isValidFileSize(50) &&
                      isValidFileName();
      allow delete: if isModerator() || isAdmin();
    }

    // System files (sitemaps, robots.txt, etc.)
    match /system/{fileName} {
      allow read: if true; // Public read for system files
      allow write: if false; // Only Cloud Functions can write system files
      allow delete: if isAdmin();
    }

    // Temporary uploads (auto-deleted after 24 hours)
    match /temp/{userId}/{fileName} {
      allow read: if isAuthenticated() && isOwner(userId);
      allow write: if isAuthenticated() &&
                      isOwner(userId) &&
                      isValidFileSize(20) &&
                      isValidFileName();
      allow delete: if isAuthenticated() && (isOwner(userId) || isAdmin());
    }

    // Admin uploads
    match /admin/{fileName} {
      allow read: if isAdmin();
      allow write: if isAdmin() &&
                      isValidFileSize(100) &&
                      isValidFileName();
      allow delete: if isAdmin();
    }

    // Security logs and audit files
    match /security/{fileName} {
      allow read: if isAdmin();
      allow write: if false; // Only security system can write
      allow delete: if false; // Never delete security files
    }

    // Default deny all other paths
    match /{allPaths=**} {
      allow read, write: if false;
    }
  }
}