storage.rules

rules_version = '2';
service firebase.storage {
  match /b/{bucket}/o {

    // Imam verification documents — readable only by the owner and admins
    match /imam_documents/{userId}/{document=**} {
      allow read: if request.auth != null && (
        request.auth.uid == userId ||
        firestore.get(/databases/(default)/documents/users/$(request.auth.uid)).data.role in ['super_admin']
      );
      // Owner may upload; file must be an image, max 5 MB
      allow create: if request.auth != null &&
        request.auth.uid == userId &&
        request.resource.size <= 5 * 1024 * 1024 &&
        request.resource.contentType.matches('image/.*');
      // No updates or deletes from client once uploaded
      allow update, delete: if false;
    }

    // All other paths are denied by default
    match /{allPaths=**} {
      allow read, write: if false;
    }
  }
}