storage.rules

rules_version = '2';
service firebase.storage {
  match /b/{bucket}/o {

    // ── Profile photos ─────────────────────────────────────────────────────
    // Any authenticated user can read (needed to display avatars).
    // Only the owner can write/delete their own photo.
    match /profile_photos/{filename} {
      allow read: if request.auth != null;
      allow write, delete: if request.auth != null
        && filename == request.auth.uid + '.jpg';
    }

    // ── Audio messages ─────────────────────────────────────────────────────
    // L'accès Firestore est la vraie barrière (isGroupMember sur les messages).
    // Ici on vérifie juste l'auth + le type + la taille.
    match /audio/{groupId}/{filename} {
      allow read:   if request.auth != null;
      allow create: if request.auth != null
        && request.resource.size < 50 * 1024 * 1024
        && request.resource.contentType.matches('audio/.*');
      allow update, delete: if false;
    }

    // ── Media messages (photos & vidéos) ───────────────────────────────────
    match /media/{groupId}/{filename} {
      allow read:   if request.auth != null;
      allow create: if request.auth != null
        && request.resource.size < 100 * 1024 * 1024
        && (request.resource.contentType.matches('image/.*')
            || request.resource.contentType.matches('video/.*'));
      allow update, delete: if false;
    }

  }
}