Fix Storage Emulator rules resource evaluation

CHANGELOG.md

@@ -1,2 +1,3 @@
 - Updates reserved environment variables for CF3 to include 'EVENTARC_CLOUD_EVENT_SOURCE' (#4196).
 - Fixes arg order for `firebase emulators:start --only storage` (#4195).
+- Fixes Storage Emulator rules resource evaluation (#4214).

scripts/storage-emulator-integration/storage.rules

@@ -2,7 +2,8 @@ rules_version = '2';
 service firebase.storage {
   match /b/{bucket}/o {
     match /{allPaths=**} {
-      allow read, write: if request.auth != null;
+      allow read, create, update: if request.auth != null;
+      allow delete: if request.auth != null && resource.name != null;
     }
 
     match /public/{allPaths=**} {

src/emulator/storage/apis/firebase.ts

@@ -591,16 +591,21 @@ export function createFirebaseEndpoints(emulator: StorageEmulator): Router {
   firebaseStorageAPI.delete("/b/:bucketId/o/:objectId", async (req, res) => {
     const decodedObjectId = decodeURIComponent(req.params.objectId);
     const operationPath = ["b", req.params.bucketId, "o", decodedObjectId].join("/");
+    const md = storageLayer.getMetadata(req.params.bucketId, decodedObjectId);
+
+    const rulesFiles: { before?: RulesResourceMetadata } = {};
+
+    if (md) {
+      rulesFiles.before = md.asRulesResource();
+    }
 
     if (
       !(await isPermitted({
         ruleset: emulator.rules,
         method: RulesetOperationMethod.DELETE,
         path: operationPath,
         authorization: req.header("authorization"),
-        file: {
-          // TODO load before metadata
-        },
+        file: rulesFiles,
       }))
     ) {
       return res.status(403).json({
@@ -611,8 +616,6 @@ export function createFirebaseEndpoints(emulator: StorageEmulator): Router {
       });
     }
 
-    const md = storageLayer.getMetadata(req.params.bucketId, decodedObjectId);
-
     if (!md) {
       res.sendStatus(404);
       return;