title: Firebase database rules: .exists() always true
body: <p>I am trying to allow people to refer friends within a game. There is a bonus for adding multiple friends and I am trying to avoid exploitation of random user names being added. So I want to check, before they add the user to their list that the user actually exists and that the user signed up with their referal code.  </p>
  
  <p>Here is an example of the structure of my database:</p>
  
  <pre><code>"friends": {
      "qwerty12345": {
          "friend1": {},
          "friend2": {},
          "friend3": {},
          "friend4": {},
      }
  },
  "users": {
      "qwerty12345": {},
      "salamander12345": {},
      "harrypotter12345": {}
  }
  </code></pre>
  
  <p>so, with the above structure;</p>
  
  <p>When someone signups there is a friend referrer set. This is the <strong>"account uid"</strong> of the friend that referred them. What I want to do is add the current user uid as a child of friends > referring friend.</p>
  
  <p>so, lets say user <code>pikachu12345</code> signs up from a link sent from their friend <code>qwerty12345</code>. The structure will look like: </p>
  
  <pre><code>"friends": {
      "qwerty12345": {
          "pikachu12345": {},
      }
  },
  </code></pre>
  
  <p>I only want to add to <code>friends &gt; qwerty12345 &gt; pikachu12345</code> <strong>if</strong> that <code>qwerty12345</code> exists in <code>users</code>. </p>
  
  <p>I have this rule set up:</p>
  
  <pre><code>"friends": {
      "$user": {
        ".write": "$user === newData.child('account_uid').val() &amp;&amp; root.child('users').child(newData.child('account_uid').val()).exists()"
      }
    },
  </code></pre>
  
  <blockquote>
    <p>Edit: newData.child('account_uid').val() = refers to the data object that is being passed (below) and this evaluates as <code>qwerty12345</code> </p>
  </blockquote>
  
  <p>However,when I set the referring friend to <code>hercule12345</code> which <strong>does not</strong> exist in the users table. It still adds it to the friends tree. </p>
  
  <p>Why is it always evaluating true?</p>
  
  <p>edit, Also in case it is relevant, this is being written using a Cloud Function:</p>
  
  <pre><code>var data = {
          account_uid: "qwerty12345",
          current_user:"pikachu12345"
      }
  admin.database().ref(`/friends/${data.account_uid}/${data.current_user}`).set(data)
  </code></pre>