storage.rules

rules_version = '2';

/**
 * Upload paths (use consistently in app code):
 *   projects/{projectId}/runs/{runId}/results/{caseId}/{fileName}
 *   (optional subfolders: .../results/{caseId}/evidence/screenshot.png — see isRunResultAttachmentPath)
 *
 * Testers: create/update only under run result paths. Deletes: test_lead / admin only.
 * Other paths under projects/{projectId}/...: read = members; write = test_lead / admin only.
 *
 * Depends on Firestore: users/{uid}.role, projects/{projectId}.memberIds
 */
service firebase.storage {
  match /b/{bucket}/o {

    function userDoc() {
      return firestore.get(/databases/(default)/documents/users/$(request.auth.uid));
    }

    function projectDoc(projectId) {
      return firestore.get(/databases/(default)/documents/projects/$(projectId));
    }

    function signedIn() {
      return request.auth != null;
    }

    function userProfileExists() {
      return signedIn() &&
        firestore.exists(/databases/(default)/documents/users/$(request.auth.uid));
    }

    function userRole() {
      return userDoc().data.role;
    }

    function canManageQualityContent() {
      return userProfileExists() && userRole() in ['admin', 'test_lead'];
    }

    function isProjectMember(projectId) {
      return signedIn() &&
        firestore.exists(/databases/(default)/documents/projects/$(projectId)) &&
        request.auth.uid in projectDoc(projectId).data.memberIds;
    }

    function isGlobalAdmin() {
      return userProfileExists() && userRole() == 'admin';
    }

    function canAccessProjectStorage(projectId) {
      return isProjectMember(projectId) || isGlobalAdmin();
    }

    /** Path after projectId/ — e.g. runs/r1/results/c1/evidence/file.png */
    function isRunResultAttachmentPath(allPaths) {
      return allPaths.matches('^runs/[^/]+/results/[^/]+/.+');
    }

    /**
     * Single match avoids overlap: one path must not satisfy two different allow rules incorrectly.
     */
    match /projects/{projectId}/{allPaths=**} {
      allow read: if canAccessProjectStorage(projectId);

      allow create, update: if canAccessProjectStorage(projectId) && userProfileExists() && (
        canManageQualityContent() ||
        (userRole() == 'tester' && isRunResultAttachmentPath(allPaths))
      );

      allow delete: if canAccessProjectStorage(projectId) && canManageQualityContent();
    }
  }
}