storage.rules

// Returns true if the given UID matches the signed in UID,
// the uploaded file is an image and its size is below the given number of MB.
// Also allow deletes.
function isImageAndBelowMaxSize(uid, maxSizeMB) {
  return request.auth.uid == uid
      && (request.resource == null // Allow deletes
          || request.resource.size < maxSizeMB * 1024 * 1024 // Max size for the uploaded file
              && request.resource.contentType.matches('image/.*')) // The file is an image
}

service firebase.storage {
  match /b/{bucket}/o {
    match /{userId}/thumb/{postId}/{fileName} {
      allow read, write: if isImageAndBelowMaxSize(userId, 1);
    }
    match /{userId}/full/{postId}/{fileName} {
      allow read, write: if isImageAndBelowMaxSize(userId, 5);
    }
  }
}