It feels like this is a lot of auth logic that's bleeding into the repository. Is there a way we could move this into securityExtension? I didn't have time to investigate if it's possible, but in theory we could just give all the information to the securityExtension and let it do all of this logic?