Personal Catalogue: React & Firebase — Chapter 3, Exercise 3
=====================================================================

TASK
Explain what real value `validateItem()` still adds once Security
Rules are deployed, given that the rules alone are now the actual,
universal gate — in other words, why wasn't Chapter 2's own work wasted
effort now that Chapter 3 exists?

SOLUTION

`validateItem()`'s real value now is speed and feedback quality, not
enforcement. Security Rules run on Firebase's own servers, which means
every rejection they produce requires a full network round trip: the
browser sends the write, waits for Firestore's response, and only then
learns the write was rejected as `Missing or insufficient permissions`
— a message that says nothing at all about *which* field was wrong or
*why*, since rules aren't designed to explain themselves to a UI.

`validateItem()` catches the exact same problems synchronously, in the
browser, before any network request is even sent, and with a real,
specific error message ("A Cd needs a artist.") that a form can display
directly to whoever's using the app. That's a meaningfully better user
experience than waiting for a round trip just to receive a generic
permission error — someone filling out the add-item form gets told
what's wrong the instant they submit, not after a delay with no useful
explanation.

So the two layers aren't redundant, they're doing genuinely different
jobs: `validateItem()` is a UX convenience aimed at a well-behaved
client following the app's own intended flow, and Security Rules are
the real, unavoidable safety net that holds even when a client isn't
well-behaved — a bypassed validator, a stray script, or a typo in a
future code path that forgets to call it. Removing `validateItem()`
would leave the app correct but with a noticeably worse add-item
experience; removing the rules would leave a real, exploitable gap no
amount of client-side discipline can fully close.

WHY THIS WORKS AS AN ANSWER
----------------------------
It correctly identifies that the two mechanisms solve different
problems (fast, specific feedback vs. universal enforcement) rather
than treating one as simply redundant with the other, and it explains
the real, concrete cost (a round trip, plus a vague error message) that
would appear if `validateItem()` were removed and Security Rules were
the only line of defense left.