dealing with "listing" apis

[chicco785]

Is your feature request related to a problem? Please describe.

APIs like orion have base end points for resource type that returns the whole content. Either these are blocked, unless a user has access to all entities, or content should be automatically filtered.

Describe the solution you'd like

Option 1. only who can list all resources of type entities and all resources of type entity type can access /entities and /types

Option 2. we compute the list of resources a user can access (is that possible with opa?) and manipulate request query so that data are correctly filtered based on that.

Describe alternatives you've considered

N/A

Additional context

N/A

[chicco785]

not relevant for the specific case, it is possible to manipulate headers and bodies in the response:
https://www.openpolicyagent.org/docs/latest/envoy-primer/#example-policy-with-object-response