storage.rules

rules_version = '2';
service firebase.storage {

  match /b/{bucket}/o {
    function isOwner(userId) {
      return request.auth.uid == userId
    }

    function isSignedIn() {
      return request.auth != null;
    }

    function requesterId() {
      return request.auth.uid;
    }
    match /gardens/{userId}/{allPaths=**} {
      allow read;
      allow write: if request.auth != null && request.auth.uid == userId;
    }

    function isValidTrailAccess(userId) {
      return isSignedIn() && isOwner(userId)
        && firestore.get(/databases/(default)/documents/users/$(requesterId())).data.superfan == true;
    }

    match /trails/{userId}/{singlePath} {
      // Only superfans (members) can upload and see trails
      allow read: if isValidTrailAccess(userId);
      allow create: if isValidTrailAccess(userId);      
      allow delete: if isValidTrailAccess(userId);
      // Updates are NOT allowed
    }
  }
}