realtime-database rule validation is not working when updating data with null

Question

When I try to update data in realtime-database with null, ".validate" in database.rules.json seems to be ignored.

I have a database.rules.json in the following format (not the exact same way, but this shows what I expect at least).

database.rules.json

"data": {
  ".read": "auth != null",
  ".write": "auth != null",
  ".validate": "newData.val() != null"
}

When I update realtime-database with

frontend.js

import { set } from 'firebase/database';

export class PublishService {
 ...

 setWithData(value) {
  // suppose dbReference has ref to "data"
  // something like ref(this.database, "data")
  set(this.dbReference, value);
 }
}

where value == null,

I can still update realtime-database with null even though this isn't what I expect.

Is this how realtime-database is supposed to work? If that's the case, is there any documentation that says that?

Answer 1

The .validate rule is not triggered for data deletions. From the documentation on .validate rules:

the validate definitions are ignored when data is deleted (that is, when the new value being written is null).

So you'll want to check for newData.exists() in the .write rule.