storage.rules

rules_version = '2';

service firebase.storage {
  match /b/{bucket}/o {
    match /Keun-files/{fileId} {
      function isSignedIn() {
        // Check if the user is logged in
      	return request.auth != null;
      }
      
      function checkRole(expectedRole) {
      	// Check the role set in the Firestore collection "roles"
      	let roles = firestore.get(/databases/(default)/documents/roles/$(request.auth.token.email)).data.roles;
        return expectedRole in roles;
      }
      
      // function getRoleClaims(arr) {
      	// Check the roles through the custom claims in the auth
      	// return request.auth.token.role in arr;
      // }
      
      function checkProvider() {
      	// All the users must be logged in through OAuth of Microsoft
        // Microsoft is not an option here so it'll be custom
      	return request.auth.token.firebase.sign_in_provider != "anonymous"
      }
      
      function isOwnerOfFile() {
      	// Check in Firestore if the user is owner of the file
        let owner = firestore.get(/databases/(default)/documents/files/$(fileId)).data.owner;
        return owner == request.auth.uid;
      }

			// The user must be logged in through Microsoft, has the role "user" || "admin"
			allow read, create, update: if isSignedIn() && checkProvider() && (checkRole('user') || checkRole('admin'));
			// The user must be logged in through Microsoft & has the role "admin" or has the role "user" and is owner of the file
      allow delete: if isSignedIn() && ((checkRole('user') && isOwnerOfFile()) || checkRole('admin')) && checkProvider();
    }

    match /Keun-deleted-files/{fileId} {
      function isSignedIn() {
        // Check if the user is logged in
      	return request.auth != null;
      }
      
      function checkRole(expectedRole) {
      	// Check the role set in the Firestore collection "roles"
      	let roles = firestore.get(/databases/(default)/documents/roles/$(request.auth.token.email)).data.roles;
        return expectedRole in roles;
      }
      
      // function getRoleClaims(arr) {
      	// Check the roles through the custom claims in the auth
      	// return request.auth.token.role in arr;
      // }
      
      function checkProvider() {
      	// All the users must be logged in through OAuth of Microsoft
        // Microsoft is not an option here so it'll be custom
      	return request.auth.token.firebase.sign_in_provider != "anonymous"
      }
      
      function isOwnerOfFile() {
      	// Check in Firestore if the user is owner of the file
        let owner = firestore.get(/databases/(default)/documents/files/$(fileId)).data.owner;
        return owner == request.auth.uid;
      }

			// The user must be logged in through Microsoft & has the role "admin"
      allow create: if isSignedIn() && ((checkRole('user') && isOwnerOfFile()) || checkRole('admin')) && checkProvider()
    }
  }
}