From d63222c2aca3cc8d4defd4ed566b19e1dd7ea6ff Mon Sep 17 00:00:00 2001
From: nicolas <nicolas@gruber.info>
Date: Mon, 14 Sep 2026 20:59:40 +0200
Subject: [PATCH] security(storage): strictly restrict delete to photo author
 or verified firestore admin

---
 storage.rules | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/storage.rules b/storage.rules
index 09a72b0..bc18f10 100644
--- a/storage.rules
+++ b/storage.rules
@@ -12,8 +12,13 @@ service firebase.storage {
         && request.resource.size < 10 * 1024 * 1024
         && request.resource.contentType.matches('image/.*');
         
-      // Fotos löschen beim Entfernen eines Beitrags (durch Verfasser oder Admin)
-      allow delete: if request.auth != null;
+      // Löschen streng gesichert: Nur der eigene Verfasser ODER ein Admin aus der Admins-Sammlung
+      allow delete: if request.auth != null && (
+        request.auth.uid == userId ||
+        request.auth.token.admin == true ||
+        firestore.exists(/databases/(default)/documents/Admins/$(request.auth.uid)) ||
+        (request.auth.token.email != null && firestore.exists(/databases/(default)/documents/Admins/$(request.auth.token.email)))
+      );
     }
   }
 }