title: How do I do authorization based on data user is trying to access in express?
body: <p>User A is sending bulk data to update existing data. Say, he can change name of various users. But I need to restrict him to only be able to change data of Group A users and not Group B users.
  If the input is this, [[1,10],[2,20],[3,11]] , I will send request to backend and check if each data belongs to Group A. If any of them don't belong to group A, I will send Error.</p>
  <p>Should I do this in Middleware where I retrieve list of users he can change and check against all of them and then next it to handler or do this authorization on handler itself?
  If I make a separate middleware, it needs to query to database which may also need to be queried again  later. What is good method?</p>