I came to the same conclusion that Kiro did when I evaluated Firebase a few months ago that I would always end up needing some server-side validation even with

I came to the same conclusion that Kiro did when I evaluated Firebase a few months ago that I would always end up needing some server-side validation even with the authentication and security rules but I think I just noticed something useful. Apparently you can get the actual data being used when writing the rules expression by using the `val` function[0] on the `data` variable[1]. However, your docs called the rules expression "Javascript-like"[2] which makes me wonder what limitations exist on the expression syntax. Since I can call `val` to get the primitive value, can I use Javascript functions/properties on those primitives like `length` on arrays? Here's a use case, given an object that looks like { name: "Adam", family: { spouse: "Eve", children: [...]}} Will the following expression work to limit changing the name of the spouse if there are more than 1 element in the children collection: "$spouse": {.write: data.child("family").val().children.length < 2} Not quite sure if you can write a rule for a property within an object but if the above works, then the rules system is pretty damn awesome :) [0] https://www.firebase.com/docs/security/rulesdatasnapshot/val.html https://www.firebase.com/docs/security/rulesdatasnapshot/val... [1] https://www.firebase.com/docs/security-quickstart.html https://www.firebase.com/docs/security-quickstart.html Ctrl+F "We use the "data variable" [2] https://www.firebase.com/docs/security-quickstart.html https://www.firebase.com/docs/security-quickstart.html Ctrl+F "We use the "Javascript-like"