Q:

can I give a web client access to the database?

I'm an old web developer thinking that only server side code should access the database to prevent data leaking and corruption. 
Now I'm trying a serverless development with google firebase. Since user authentication is managed, it seems possible to configure the database (firestore) access rules so that each user can only modify its own data (or read public data).
This would be nice, because otherwise I should write a server side api to give access to the database from the client. However I'm a little bit scared: is this a suggested practice? 
For example: if the user is given authorization to create new objects, how can I check that objects are created consistently? 
Maybe I can have a mixed access policy? For read query I can give direct access to the database but maybe I should deploy write queries on the server side?
I think that all of this should be discussed somewhere. Maybe I'm missing some keyword to find the topics.

A:

Yes. It's totally normal and expected for your web client to have a Firebase API key and be able to access the database directly. As you noted, you're generally relying on security rules to make sure people can only access certain data, as well as make sure that documents written to the database are consistent.
For what it's worth, I'm a fan of the mixed-access policy you're talking about -- especially when it comes to more complex write that might span several documents in the database. It's sometimes easier to keep a separate "pending user writes" collection in your database, and then have a cloud function do more of the heavy lifting of propagating that action throughout your database.
If you want more info, there's a video all about this topic I can recommend :)

