storage.rules

rules_version = '2';

service firebase.storage {
  match /b/{bucket}/o {
    function activeManager(orgId) {
      return request.auth != null
        && request.auth.token.firebase.sign_in_provider != 'anonymous'
        && firestore.exists(/databases/(default)/documents/organizations/$(orgId)/members/$(request.auth.uid))
        && firestore.get(/databases/(default)/documents/organizations/$(orgId)/members/$(request.auth.uid)).data.role == 'MANAGER'
        && firestore.get(/databases/(default)/documents/organizations/$(orgId)/members/$(request.auth.uid)).data.active == true;
    }

    match /organizations/{orgId}/payouts/{payoutId}/proof/payment-proof {
      allow read: if activeManager(orgId);
      allow write: if activeManager(orgId)
        && request.resource.size <= 10 * 1024 * 1024
        && request.resource.contentType in [
          "image/jpeg",
          "image/png",
          "image/webp",
          "image/heic",
          "image/heif"
        ];
    }

    // Checklist evidence has no browser access until deliberately implemented.
    match /{allPaths=**} {
      allow read, write: if false;
    }
  }
}