Firebase 存储规则，保留路径打开

Question

Now that firebase has forced using rules scrambling to find the right solution here. I have all images in the main bucket and every user once logged in has something like bucket

users/{uid}/uploads

where all there uploaded photos go (would be cool to restrict to images at some point) these should be public read and write, if write can be only for the authenticated user even better, but auth to read is necessary.

there is a special folder before a user is authenticated and need upload a profile pic

users/uploads

which should be read write to the public here is what i have but the second rule takes precedence

 service firebase.storage {
  match /b/{bucket}/o {
    match /users {
        match /uploads {
            match /object {
            allow read, write
            }
        }
        }
    match /{allPaths=**} {
       allow read, write: if request.auth != null
    }
  }
}

I'm thinking it probably needs to be a not /users/uploads forthen then do do this but the documentation is bad for if else statements. any thoughts?

EDIT: this rule set works for reading correctly but still can't write when unauthenticated during sign up

service firebase.storage {
  match /b/{bucket}/o {
    
    // Allow only authenticated users to upload
    // Any user can read
    match /users/uploads {
      allow read, write;
    }
  
    // Only allow user with auth.uid == uid to read/write
    match /users/{uid}/uploads {
       allow read: if true;
       allow write: if request.auth.uid == uid;
    }
  }
}

Answer 1

You can try the following rules that'll restrict access to user's own directory and also have a public folder:

rules_version="2";
service firebase.storage {
  match /b/{bucket}/o {

    // Allow only authenticated users to upload
    // Any user can read
    match /users/uploads {
      allow read: if true;
      allow write: if request.auth != null; 
    }
    
    // Only allow user with auth.uid == uid to read/write
    match /users/{uid}/uploads {
       allow read: if true;
       allow write: if request.auth.uid == uid;
    }
  }
}

Do note that if request.auth;= null; allows everyone write (including delete) so try using allow create: only.