node.js - Restricting access to documents to facebook friends in mongodb -

i'm building simple photo storage app has 3 resources using mongodb mongoose:

• users
• albums
• photos

all authentication handled passportjs.

a user can have many albums , album can have many photos using parent references.

the albums each have different privacy setting:

• private - create can see it
• public - can see it
• friends - people (facebook) friends can see it

when make query many albums want see mixture of 3 based on user logged in question how should check if user logged in facebook friend creator?

facebook provides endpoint check if 2 users friends mean iterating through collection , making request on each , filtering results , returning them, me, seems lot of leg work.

another approach (still without flaws):

1. user signs , allows app friends using app
2. store these friends _id in array on user
3. when user creates album, save copy of array onto field on album
4. query using $in operator using logged in users id

pros:

• list item
• quickly check if user friend of user created album
• no additional requests needed facebook

cons:

• friend list set once, if friend list changes needs updated somehow

• friend list in multiple locations (on user , on x number of albums) needs updated across these somehow

• when new friend signs up, may have friends on app, need find each of friends , add new friend friends list , remove if need be.

these ways can think of, can offer new methods or perhaps improvements ones above? maybe i'm looking @ wrong way , theres simple solution using other mongo functionality?

you can use me/friends edge receive all friends (that have authorised app) seed own list. then, can use webhooks subscribe changes on user.friends edge. when happens, can update list of friends, version up-to-date.