title: Firebase variable based authorization
body: <p>I've been using Firebase for one of my games and while it's been an extremely useful service and tool I happened to come across an issue that I didn't address during development which has allowed users to cheat.</p>
  
  <p>As you would expect with Firebase that introduces most of the logic on the client side, I have client-side authorization in place, which was a mistake from the start to begin with. The issue that I'm running into is the following. Please note that this is not my structure, just an example to work from.</p>
  
  <pre><code>{
    "user": 
    {
      currently_training: false,
      current_units: 673,
      unit_cap: 1000
    }
  }
  </code></pre>
  
  <p>The client would take this and tell the user, "Okay, you're only allowed to train <code>(1000 - 673) = 327</code> units. However, by bypassing this on the client side to change the unit_cap to lets say <code>10,000</code> the user can now send a request to the database to create <code>9,327</code> units, which will result in his units exceeding his unit cap.</p>
  
  <p>How would I go about validating a query, such as..</p>
  
  <pre><code>- User requests to train 412 units.
  - Insert is not executed as the amount of requested units + current_units &gt; unit_cap
  - Error is sent back to client to be handled.
  
  OR
  
  - User requests to train 300 units.
  - 300 + current_units &lt;= unit_cap
  - Insert executes successfully.
  
  OR
  
  - User requests to train 300 units.
  - 300 + current_units &lt;= unit_cap
  - currently_training is true, so the Insert fails with error.
  </code></pre>
  
  <p>I'm fairly worried that creating a middleware server is going to be required, which is the reason I went with firebase to begin with. (So I wouldn't have to worry about the scalability of my own servers)</p>