storage.rules

rules_version = '2';

service firebase.storage {
  match /b/{bucket}/o {
    
    // ========== PROFILE PICTURES ==========
    match /profilePictures/{userId}.jpg {
      // Read: Only the owner can read their profile picture
      allow read: if request.auth != null && request.auth.uid == userId;
      
      // Write: Only the owner can upload their profile picture
      // Constraints: Max 1MB, must be an image
      allow write: if request.auth != null && 
                      request.auth.uid == userId &&
                      request.resource.size < 1 * 1024 * 1024 &&
                      request.resource.contentType.matches('image/.*');
    }
    
    // ========== DEFAULT DENY ALL ==========
    match /{allPaths=**} {
      allow read, write: if false;
    }
  }
}