rest - Restricting Data Returned from a Grails Restful Service with AngularJS -

i new using angularjs , wanted integrate grails using rest. while have found many great tutorials on using grails/angularjs perform crud operations, have found little me understand best way restrict data returned angular grails restful service based on user logged in. hate ask opinion question here know bit frowned upon in case think relevant , beneficial others learning how build real world applications grails/angular.

so lets have simple domain class:

    class book {      string title     string author      static constraints = {     } } 

and expose restful controller (plain vanilla)

    import grails.rest.restfulcontroller  class bookcontroller extends restfulcontroller<book>{      def springsecurityservice     static responseformats = ['json', 'xml']      bookcontroller(){         super(book)     }  } 

in case using asset-pipeline grails plugin. have angular controller:

var book = angular.module('book', []);  book.controller('bookctrl',     function ($scope, $http) {          $scope.getbook = function () {             $http.get('/myapp/book').                 success(function (data) {                     console.log("success: " + data);                     $scope.book = data;                 }).error(function (data) {                     console.log("error: " + data);                     $scope.book = data;                 });         };          $scope.getbook();     } ); 

and view (abbreviated):

    <div>         <table class="table table-hover">             <tr>                 <th>title</th>                 <th>author</th>             </tr>              <tr ng-repeat="b in book">                 <td>{{b.title}}</td>                 <td>{{b.author}}</td>             </tr>         </table>     </div> 

when looking list of book objects works fine, nice table of books. when limit books returned based on user logged in (let's in case list of books user owns), not sure may best way proceed. authentication standpoint thought perhaps using spring security rest plugin might helpful in passing token parameter bookcontroller (assuming override index() method). token , filter results in rest response. seem proper approach? thank feedback,

yes, refer sample angular/grails app uses grails-spring-security-rest plugin token based authn/authz. answer question, have both:

1. token based authentication client (angular) access rest service.
2. filtering user owning books in server side.

token based authentication showcased in sample app. filtering user, might end doing in controller:

def index() {      //getprincipal() method on controller metaclass     //used here convenience similar saying     //springsecurityservice.principal.username      respond book.findbyuser( principal.username ) } 

above work based on assumption mentioned there join table somewhere logged in user owns books.