fix(storage): allow unauthenticated participants to upload media into storage for public tests (#2286)

[chirag-gupta-07]

Description

Resolves an issue where unauthenticated / anonymous participants could not upload screen, audio, or video recordings during public user tests due to restrictive Firebase Storage security rules and unconfigured storage initialization in media recorder components.

Problem

1. Firebase Storage Security Rules: storage.rules did not allow unauthenticated access to the test upload paths (tests/{studyId}/{userId}/...) even when the test was configured as public (study.isPublic == true). This resulted in 403 Forbidden (storage/unauthorized) errors when submitting recordings.
2. Storage Instance Initialization: Media recorder components (ScreenRecorder.vue, AudioRecorder.vue, VideoRecorder.vue) were calling getStorage() directly without configuration, causing requests to route to production Firebase Storage instead of the configured emulator, triggering CORS failures.
3. Screen Recording Filename: ScreenRecorder.vue was not generating a valid timestamped .webm filename, causing upload path issues.

---

Related Issue

Fixes #2286

---

Changes Made

• storage.rules: Added study(studyId).isPublic == true check to canAnswerStudy and match /tests/{studyId}/{userId}/{allPaths=**} to allow unauthenticated read and upload access for public studies.
• ScreenRecorder.vue:
  • Imported and used the configured storage instance from @/app/plugins/firebase.
  • Updated filename generation to format as unique timestamped .webm (${Date.now()}.webm).
• AudioRecorder.vue & VideoRecorder.vue:
  • Imported and used the configured storage instance from @/app/plugins/firebase.

---

How to Test

1. Start the development/emulator environment.
2. Create an unmoderated User Test and set it to Public in the Settings tab.
3. Add a Task with Screen Recording enabled.
4. Open the participant link in an Incognito / Private Window (without being logged in).
5. Complete the task, allow screen recording, and submit.
6. Verify that the recording uploads successfully without any 403 or CORS errors and the .webm file is present in Firebase Storage.

---

Video Proof

Part 1-

Part.1.mp4

Part 2-

Part.2.mp4

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[chirag-gupta-07]

@KarinePistili Take a look at this PR.