How do you deal with permission management when using Elasticsearch indexes?

I am using django-guardian for per-object permission management and django-elasticsearch-dsl for quicker queries across our data. It's pretty straightforward for public lists, but I am having difficulties designing a scalable permission management, so that the filtered list would show only those items that the current user request.user has access to view and change.

Some solutions suggested by AI:

• Get a list of uuids that the user has access to, and then filter items in elasticsearch by those uuids (not very scalable).
• Post-process the public results with django-guardian API functions - however that takes too long for entries with tens of thousands of results (there is a possibility to skip pagination and process only the first page, but that's not preferable).
• Add a list of user ids and group ids who can view, edit, and delete items to the item index and check the current user's id and group ids against those fields.
• Create an index for the User model with all viewable, editable, and deletable items by their uuids and then do terms_lookup in that index to filter list of items in question by the uuids the user can access.

All those approaches are questionable to me, when I am thinking about tens of thousands of items or users.

What do you use or would use in such a case?

Back to Top