storage.rules

rules_version = '2';
service firebase.storage {
  match /b/{bucket}/o {

    // Helper function: Check if user is authenticated
    function isAuthenticated() {
      return request.auth != null;
    }

    // Helper function: Check if user is admin
    function isAdmin() {
      return isAuthenticated() &&
             request.auth.token.admin == true;
    }

    // Repository cache (backend functions only)
    match /repositories/{repoId}/{allPaths=**} {
      allow read: if isAuthenticated();
      allow write: if false; // Only backend functions can write
    }

    // Embeddings (backend functions only)
    match /embeddings/{allPaths=**} {
      allow read: if false; // Private to backend
      allow write: if false; // Only backend functions can write
    }

    // User data exports (GDPR compliance)
    match /exports/{userId}/{fileName} {
      allow read: if isAuthenticated() && request.auth.uid == userId;
      allow write: if false; // Only backend functions can write
    }

    // Backups (admin only)
    match /backups/{allPaths=**} {
      allow read: if isAdmin();
      allow write: if false; // Only backend functions can write
    }
  }
}