firebase data validation failing - validation

Question

First time working with Firebase on a new project and I'm getting a permission denied message when writing an activity event when I include a validation rule.
The validation rule looks like:
"activity": {
".read": "auth != null",
".write": "auth != null",
".validate": "newData.hasChildren(['user'])",
".indexOn": ["when"]
}
On a new activity event, I push a new entry, grab the token ID and make it (for now) part of the data being pushed. When watching this in debug (using a custom token authentication system) this is what I see. The json pushed has a "user" entry that is the GUID of the auth user so I'm not sure why it's failing. I spaced out the json text.
utility.js (line 1675)
FIREBASE: Attempt to write {
"id":"-K4oomuOpaY4K2aGUYZA",
"imp":false,
"text":"xxx.",
**"user":"0648480c-xxx"**,
"when":1449363973059
} to /activity/## with auth={"uid":"0648480c-xxx","name":"Greg Merideth"}
/activity:.write: "auth != null" => true
/activity:.validate: "newData.hasChildren(['user'])" => false
FIREBASE: Validation failed. firebase.js (line 195)
FIREBASE: Write was denied firebase.js (line 195)
I even tried changing the rule to ".validate": "newData.hasChild('user')" with the same end result.
Is newData looking at the inbound packet or my "auth" packet?
Update (from the comments)
The addition of a new item calls a function passing in the fbActivity handler which then calls:
var message = fbActivity.push({
id: user.fn(),
text: t.val(),
imp: false,
user: user.uid(),
when: new Date().getTime()}
To push the new entry. We're not using the fb.timestamp as our server runs 3 seconds behind fb's so our time stamps come out weird.

Answer 1

I'm guessing that you're calling push() to add a new child under activity. In that case, your rules are missing the extra level that is generated by push():
"activity": {
"$activityid": {
".read": "auth != null",
".write": "auth != null",
".validate": "newData.hasChildren(['user'])",
".indexOn": ["when"]
}
}
If that is the case, please take time to read the Firebase security guide, which explains this and many other useful bits about the language.