firestore and storage rules

storage.rules

@@ -0,0 +1,20 @@
+rules_version = '2';
+
+service firebase.storage {
+  match /b/{bucket}/o {
+    match /messages/{fileName} {
+
+      // anyone can view uploaded images
+      allow read: if true;
+
+      // anyone can upload an image attached to a message
+      // must be an image under 5MB
+      allow create: if
+        request.resource.size < 5 * 1024 * 1024 &&
+        request.resource.contentType.matches('image/.*');
+
+      // no edits or deletes through the client
+      allow update, delete: if false;
+    }
+  }
+}