title: Check user permissions in RESTful API
body: <p>I'm developing a SaaS API with NodeJS, Express, MongoDB. It has implemented a JWT authentication/security methodology.</p>
  
  <p>In my personal case, I have (for now) two collections: User and Client.</p>
  
  <p><a href="https://i.stack.imgur.com/yraHj.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/yraHj.png" alt="enter image description here"></a></p>
  
  <p>You can see the fields that each collection has (for defining purposes). So in terms of endpoint design I'm using a trully restful approach so:</p>
  
  <ul>
  <li>/api/users/{userId}/clients: to insert clients i.e.</li>
  </ul>
  
  <p>This is exactly the point I'm bringing I want, that before posting a new client to check if the price plan allows the user to do that. In terms of logic:</p>
  
  <pre><code>function post(req,res){
      // Check if the JWT user.id is the same of the endpoint request
      if(req.user._id == req.params.id){ 
         // Here I want to know which is the price plan and to count the Clients that the user has
  
     }
  }
  </code></pre>
  
  <p>In terms of my doubts I have thought in some hypothesis but I truly don't know which one is the best:</p>
  
  <ul>
  <li>Do a query in the User collection get the price plan, do a query count on the Clients collection validate and then post the new Client.</li>
  <li>Put the User's price plan information in the JWT, do a query count on the user's Clients collection validate and then post the new Client.</li>
  </ul>
  
  <p>These are the two main possible solutions I thought about, but I have serious doubts security and performance wise of which one I should implement/follow.</p>
  
  <p>Thank you in advance.</p>