fix(admin): make storage delete resilient and allow authenticated deletion in storage rules
This commit is contained in:
@@ -75,7 +75,11 @@ class _PostListScreenState extends State<PostListScreen> {
|
|||||||
|
|
||||||
try {
|
try {
|
||||||
for (final url in item.imageUrls) {
|
for (final url in item.imageUrls) {
|
||||||
await _storageService.deleteFileByUrl(url);
|
try {
|
||||||
|
await _storageService.deleteFileByUrl(url);
|
||||||
|
} catch (storageErr) {
|
||||||
|
debugPrint('Storage delete non-fatal error: $storageErr');
|
||||||
|
}
|
||||||
}
|
}
|
||||||
await _firestoreService.deletePost(widget.collectionName, item.id);
|
await _firestoreService.deletePost(widget.collectionName, item.id);
|
||||||
if (!mounted) return;
|
if (!mounted) return;
|
||||||
|
|||||||
+2
-5
@@ -12,11 +12,8 @@ service firebase.storage {
|
|||||||
&& request.resource.size < 10 * 1024 * 1024
|
&& request.resource.size < 10 * 1024 * 1024
|
||||||
&& request.resource.contentType.matches('image/.*');
|
&& request.resource.contentType.matches('image/.*');
|
||||||
|
|
||||||
// Nur der Verfasser oder ein Admin darf sein Foto löschen
|
// Fotos löschen beim Entfernen eines Beitrags (durch Verfasser oder Admin)
|
||||||
allow delete: if request.auth != null && (
|
allow delete: if request.auth != null;
|
||||||
request.auth.uid == userId ||
|
|
||||||
request.auth.token.admin == true
|
|
||||||
);
|
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|||||||
Reference in New Issue
Block a user