title: Designing safe and efficient API for item state updates via events
body: <p>Recently I've been working on a simple state-tracking system, its main purpose is to persist updates, sent periodically from a mobile client in relational database for further analysis/presentation.</p>
  <p>The mobile client uses JWTs issued by AAD to authenticate against our APIs. I need to find a way to verify if user has permissions to send an update for a certain Item (at this moment only its creator should be able to do that).</p>
  <p>We assume that those updates could be sent by a lot of clients, in small intervals (15-30 seconds). We will only have one Item in active state per user.</p>
  <p>The backend application is based on Spring-Boot, uses Spring Security with MS AAD starter and Spring Data JPA.</p>
  <p>Obviously we could just do the following:</p>
  <ol>
  <li>User_1 creates Item_1</li>
  <li>User_1 sends an Update for Item_1</li>
  </ol>
  <p>Item has an owner_ID field, before inserting Update we simply check if Item_1.owner_ID=User_1.ID - this means we need to fetch the original Item before every insert.</p>
  <p>I was wondering if there was a more elegant approach to solving these kind of problems. Should we just use some kind of caching solution to keep allowed ID pairs, eg. {User_1, Item_1}?</p>