While building microservice-based architecture I came across a dilemma on how to approach company level permissions for given range (or ids) of resources, i.e. allowing certain users to access subset of data for the company that the person is working at.
I have number of services, Invoices, Company, Orders etc. Each service has an access to corresponding data sources, Company has users table as well as company.
Company can have multiple users. Just to give a less abstract example: Invoices table has customer_id and company_id, but customer data lies within Company service's database, so there are no direct links.
Company admin can specify that certain user is able to see only invoices for specific customers.
And currently the only access that was checked was whether user has role for accessing certain action e.g. View Invoices. If yes, then Invoice service would return invoices for given user's company id. This check was done in Gateway service.
But now if I want to make it more granular i.e. return invoices only for given company AND customer_id I can extend the services endpoints to accept additional parameters, which is list of available customers. Which is pretty bad as one company can have thousand of customers, and sending ever increasing payload for each action seems like an overkill. That would also require expanding ALL dozen of endpoints just to pass that filter logic down to the repositories.
Another idea is to leave services to return the data in unchanged way but add additional filter on Gateway level that would return only those that match available customers for given user.
Third idea is to create separate service that would be called by each service for the list of ids that given user can access. But that feels like too much coupling as each service would have dependency on that specific one.
Do you have any additional ideas or good practices or even well described case studies on how to solve similar problem? Would you choose any of aforementioned solutions?