JSON:API is declared as a must-have for decoupled Drupal websites.
While I completely (well, I hope so) understand the built-in Drupal permissions/access restriction system, I have a specific use-case and I would like to understand how can I implement what I need with so much advertised JSON:API approach taking into account potential security issues described below.
So far I was only able to accomplish the task using Views REST display, disabling default JSON:API endpoints and creating my own JSON:API resources, because Views allow me to have hard server-side restrictions while filtering the content and custom JSON:API resource gives me control over the content I deliver.
Well, so there are 2 sections on my website:
- There is a public section with Articles. Any logged-in user can see all the published articles. I can deliver this page using Views as a separate page, Views REST or JSON:API to some PWA, doesn't matter. So far so good.
- There is a restricted section on the website (kind of dashboard) with the list of the articles created by the currently logged in user. Not only the User is able to see the publicly available fields, but some private fields too. User should not be able to see the other users' articles. For the purpose of this question, let's say that seeing all the articles in general via  route is not a problem from security standpoint, but seeing all the articles per user is a problem. In general, I do not what the users to know who is the author of each article.
We need to somehow separate an access restrictions for (1) and (2), even though both operations are going as 'view entity'. But (1) delivers all the articles regardless of the author, (2) delivers articles owned by the currently logged in user only.
I can build a view for a public section, but I like to use a PWA for my dashboard, so the articles are delivered using JSON:API there.
Problem from permissions standpoint
Now I can not use default permissions settings (i.e. adding/removing 'View Article' permission) because this breaks route (1) [means: users without 'View Article' permission can not see the list anymore] At the same time, I can not just rely on the query when returning the articles for the dashboard request (2) of some specific user, because let's say some advanced user sees the parameters I include in the request, he changes those parameters and - boom - sees the articles created by the other user, which is a security breach.
Problem with different fields visibility
Same question applies to the fields. When I show the (1) route (all articles), I might need to output public fields only, while when I deliver the content to (2) [per-user dashboard], I need to deliver all the fields.
Final question number one
So my question is: how can I solve this? How can I deliver same content using JSON:API with checking the owner server-side, not passing the owner as a parameter, and without restricting an access using built-in permissions system?
[EDIT] Final question number two
Is there a way for me to declare a security context (read: declare needed permission to be checked against each entity) before actually outputting/processing the data using JSON:API? Good example would be custom route with custom permissions check, while JSONAPI, as far as I am concerned, only consider CRUD entity-related permissions based on GET/POST/PUT/DELETE method being used.