Firebase storageでのグループ認証 ref: https://qiita.com/wicket/items/85115c4a6045f4d5fecd

file0.txt

{ 
  users:{
    userA :  {
      groups : {
        groupA : true
        groupB : true
      }  
    }，
    userB :  {
      groups : {
        groupB : true
        groupC : true
      }  
    }
  }
}

index.js

exports.updateUserGroupGrant = functions.database.ref('/users/{userId}/groups')
    .onWrite(event => {
      return refreshCustomClaims(event.params.userId);
    });

function refreshCustomClaims(userId){
  return admin.database().ref('/users/' + userId + "/groups").once('value').then((snapshot) => {
    var claim = {};
    for (var key in snapshot.val()){
      claim[key] = true;
    }
    return admin.auth().setCustomUserClaims(userId, claim);
  });
}

strage.rules

service firebase.storage {
  match /b/{bucket}/o {
    match /groups/{groupId} {
       match /{path=**} {
          allow read, write: if request.auth!=null
                            && request.auth.token[groupId] == true;
       }
    }
  }
}