I've been down in the weeds a bit when it comes to authorization. Every resource in my system has its group information in an attribute {:rights {:c [..list of

I've been down in the weeds a bit when it comes to authorization. Every resource in my system has its group information in an attribute {:rights {:c [..list of groups], :r [..] :u [..] :d [..]} ....rest of resource...}. In parallel with the resource as above, there is an index table for all of the resources in the system. When a resource, our group of resources is queried, I filter the index table with the groups for the current user and join to the resource table. I can only bring back resources for which the user has rights for the operation. This means that I can't ever have a 403. All I can return is a 401 or 404 or a 200 with an empty list. I kept fretting about this. Now I feel better. #how-i-stopped-worrying-and-learned-to-love-the-atomic-codes.