firebase.storage.rules

rules_version = '2';

service firebase.storage {
  match /b/{bucket}/o {

    match /games/{game}/thumbnail {
      allow read: if isLoggedIn();

      match /{fileName} {
        allow get;
        allow list: if isLoggedIn();
        allow delete: if isLoggedIn() && isFileOwnerAndMemberOrAdmin();
        allow create, update: if isLoggedIn() && isFileOwnerAndMemberOrAdmin() && isBellowMaxSize() && isValidContentType();
      }
    }

    function isLoggedIn() {
      return request.auth != null;
    }
    
    function isAdmin() {
      return request.auth.token.admin == true;
    }

    function isMember() {
      return request.auth.token.member == true;
    }

    function isFileOwner() {
      return getResource().metadata.authorUid == request.auth.uid;
    }

    function isFileOwnerAndMemberOrAdmin() {
      return isAdmin() || (isMember() && isFileOwner());
    }

    function isBellowMaxSize() {
      // Only allow uploads of any image file that's less than 5MB
      return request.resource.size < 5 * 1024 * 1024;
    }

    function isValidContentType() {
      return request.resource.contentType.matches('image/(png|jpeg)');
    }
    
    function getResource() {
      return resource == null ? request.resource : resource
    }
  }
}