storage.rules

rules_version = '2';
service firebase.storage {
  match /b/{bucket}/o {
    // Vendor images - vendors can upload to their own folder, admins can upload anywhere
    match /vendors/{vendorId}/{allPaths=**} {
      allow read: if true;
      allow write: if request.auth != null && 
        (request.auth.uid == vendorId || 
         getUserRole() == 'admin');
    }
    
    // Hero images - admin only
    match /hero-images/{allPaths=**} {
      allow read: if true;
      allow write: if request.auth != null && getUserRole() == 'admin';
    }
    
    // Profile images
    match /profile-images/{userId}/{allPaths=**} {
      allow read: if true;
      allow write: if request.auth != null && 
        (request.auth.uid == userId || getUserRole() == 'admin');
    }
    
    // Helper function to get user role
    function getUserRole() {
      return firestore.get(/databases/(default)/documents/users/$(request.auth.uid)).data.role;
    }
  }
}