I came to the same conclusion that Kiro did when I evaluated Firebase a few months ago that I would always end up needing some server-side validation even with the authentication and security rules but I think I just noticed something useful.

Apparently you can get the actual data being used when writing the rules expression by using the `val` function[0] on the `data` variable[1]. However, your docs called the rules expression "Javascript-like"[2] which makes me wonder what limitations exist on the expression syntax. Since I can call `val` to get the primitive value, can I use Javascript functions/properties on those primitives like `length` on arrays?

Here's a use case, given an object that looks like

    { name: "Adam", family: { spouse: "Eve", children: [...]}}

Will the following expression work to limit changing the name of the spouse if there are more than 1 element in the children collection:

    "$spouse": {.write: data.child("family").val().children.length < 2}

Not quite sure if you can write a rule for a property within an object but if the above works, then the rules system is pretty damn awesome :)

[0] https://www.firebase.com/docs/security/rulesdatasnapshot/val...

[1] https://www.firebase.com/docs/security-quickstart.html Ctrl+F "We use the "data variable"

[2] https://www.firebase.com/docs/security-quickstart.html Ctrl+F "We use the "Javascript-like"