Hey, question around fine-grained permissions and best practices. If an app handles tons of documents and users can have fine-grained relation to those documents/objects, how would you handle queries/requests for lists of documents that a user has access to?
I mean, currently, in my app (where we are not using SpiceDB or any other FGA engine), we have endpoints that let users list documents. Those endpoints are paginated and support both filtering and sorting. If we end up adding SpiceDB to this mix, what would be the proposed solution to keep supporting those paginated, filterable and sortable queries/endpoints?
Would we have to first get a list of documents that the caller has from SpiceDB and then use that list while querying the database (seems tricky if the user has many fine-grained relation to documents directly instead of, e.g., folders)? I guess the other option would be having some sort of many to many table on the DB that keeps track of what users have access to so we could add as a join table on the query, but that seems awkward as we would to always have the DB and SpiceDB in sync (kind of defeating the purpose of using SpiceDB in the first place?).
Anyway, suggestions would be appreciated!