storage.rules

rules_version = '2';
service firebase.storage {
  match /b/{bucket}/o {
    // Scans folder - users can only access their own images
    match /scans/{userId}/{allPaths=**} {
      // Allow read if user is authenticated and accessing their own folder
      allow read: if request.auth != null && request.auth.uid == userId;
      
      // Allow write if user is authenticated and uploading to their own folder
      allow write: if request.auth != null 
                   && request.auth.uid == userId
                   && request.resource.size < 10 * 1024 * 1024 // 10MB limit
                   && request.resource.contentType.matches('image/.*');
      
      // Deny all other operations
      allow delete: if false;
    }
    
    // Deny all other access
    match /{allPaths=**} {
      allow read, write: if false;
    }
  }
}