I'm interested in this bit: > Search API: An API endpoint that clients can issue search queries to. It needed to do all the permission checks to make sure that

I'm interested in this bit: > Search API: An API endpoint that clients can issue search queries to. It needed to do all the permission checks to make sure that clients are only searching messages they actually have access to. We've had to implement this exact thing for our index, and were never quite sure if we were doing it right. To "prepend" a security clause/condition into an incoming search query felt awkward and hacky.