Exercise 3: Why the Cloud Function Can Still Write Despite write: if false — Possible Solution
====================================================================

WHY THE CLOUD FUNCTION IS UNAFFECTED
------------------------------
Per this chapter, Chapter 3's Cloud Function writes to barcodeCache using the Firebase Admin SDK, not the regular client-side Firestore SDK. Security Rules only govern access from the client SDK - they are the gatekeeper standing between an app running in a user's browser and the database. Admin SDK access, used inside trusted server-side environments like Cloud Functions, bypasses Security Rules entirely by design.

THE MECHANISM THAT EXPLAINS THIS
------------------------------
The distinction is which SDK is making the request, not which "user" is making it. The Admin SDK runs inside Firebase's own trusted server environment - the same kind of trusted environment a genuine secret would live in - and is granted elevated access that isn't subject to the same rules a client would be. So `allow write: if false` correctly blocks every client-side write attempt to barcodeCache, while the Cloud Function, using the Admin SDK, continues writing to that same collection without any rule ever being evaluated against it.

WHY THIS WORKS AS AN ANSWER
------------------------------
It correctly identifies the Firebase Admin SDK, used inside the Cloud Function, as the reason Security Rules don't apply to that write, and correctly explains that rules govern client-side access specifically, not all access to the database regardless of origin.