storage.rules

rules_version = '2';
service firebase.storage {
  match /b/{bucket}/o {
    // Helper functions
    function isAuthenticated() {
      return request.auth != null;
    }
    
    // Submissions folder - users can upload to their own folder
    match /submissions/{assignmentId}/{userId}/{fileName} {
      // Users can read their own files, trainers can read all
      allow read: if isAuthenticated();
      // Users can only upload to their own folder
      allow write: if isAuthenticated() && request.auth.uid == userId
                   && request.resource.size < 10 * 1024 * 1024; // Max 10MB
    }
    
    // Materials folder - trainers/admins can upload session materials
    match /materials/{sessionId}/{fileName} {
      // Everyone can read materials
      allow read: if isAuthenticated();
      // Only authenticated users can upload (role check done in app)
      allow write: if isAuthenticated()
                   && request.resource.size < 50 * 1024 * 1024; // Max 50MB
    }
    
    // Default deny all other paths
    match /{allPaths=**} {
      allow read, write: if false;
    }
  }
}