security(storage): strictly restrict delete to photo author or verified firestore admin

2026-09-14 20:59:40 +02:00
parent c62d41f44a
commit d63222c2ac
1 changed files with 7 additions and 2 deletions
@@ -12,8 +12,13 @@ service firebase.storage {
        && request.resource.size < 10 * 1024 * 1024
        && request.resource.contentType.matches('image/.*');
        
-      // Fotos löschen beim Entfernen eines Beitrags (durch Verfasser oder Admin)
-      allow delete: if request.auth != null;
+      // Löschen streng gesichert: Nur der eigene Verfasser ODER ein Admin aus der Admins-Sammlung
+      allow delete: if request.auth != null && (
+        request.auth.uid == userId ||
+        request.auth.token.admin == true ||
+        firestore.exists(/databases/(default)/documents/Admins/$(request.auth.uid)) ||
+        (request.auth.token.email != null && firestore.exists(/databases/(default)/documents/Admins/$(request.auth.token.email)))
+      );
    }
  }
 }