storage.rules

rules_version = '2';
service firebase.storage {
  match /b/{bucket}/o {

    // Path segment must be a single wildcard; `uid.jpg` is matched as filename.
    match /avatars/{fileName} {
      allow read: if request.auth != null;
      allow write: if request.auth != null
        && fileName == request.auth.uid + '.jpg'
        && request.resource.size < 5 * 1024 * 1024
        && request.resource.contentType.matches('image/.*');
    }

    // Fotos de cápsula (upload futuro): autenticado pode ler/escrever no MVP;
    // refine para sender-only quando os paths forem padronizados.
    match /capsules/{allPaths=**} {
      allow read, write: if request.auth != null;
    }

    // Carta manuscrita (foto) — app grava em handwritten/{uid}_{ts}.jpg
    match /handwritten/{fileName} {
      allow read: if request.auth != null;
      allow write: if request.auth != null
        && request.resource.size < 5 * 1024 * 1024
        && request.resource.contentType.matches('image/.*');
    }

    // Mensagem de voz — até ~1 min (limite de tamanho como backstop)
    match /voiceLetters/{fileName} {
      allow read: if request.auth != null;
      allow write: if request.auth != null
        && request.resource.size < 5 * 1024 * 1024
        && request.resource.contentType.matches('audio/.*');
    }
  }
}