storage.rules

rules_version = '2';
service firebase.storage {
  match /b/{bucket}/o {
    function isSignedIn() {
      return request.auth != null;
    }

    function isUser(userId) {
      return request.auth.uid == userId;
    }
    
    // Allow initial file upload
    match /uploads/{processId}/{userId}/{dateString}/{allPaths=**} {
      allow write: if 
        isSignedIn() &&
        request.resource.size <= 7 * 1024 * 1024;  // 7MB limit
      allow read: if false;
    }

    // Allow access to generated files
    match /generated/{processId}/{userId}/{allPaths=**} {
      allow read: if 
        isSignedIn() && 
        isUser(resource.metadata.userId);
      allow write: if false;
    }
    
    // Default deny
    match /{allPaths=**} {
      allow read, write: if false;
    }
  }
}