Thanks @verneleem for the complete example.
This seems incredibly complicated. I also use firebase for my auth, which is already overly complicated until Field-level auth is implemented in the upcoming release.
I am going to stick with Option 2, which I am so happy it exists (despite the fact JSON is not accepted at this time in dql lambdas).
I have a feeling as slash-dgraph gets more mature, and I get more mature in my dgraph development, I will come back to this example needing more complicated security.
Thank you!
J