title: Web API filter data by user permission
body: <p>Which is the best way to filter a data list from data base using user's permission?</p>
  
  <p>For example:
  I have a controller that returns a list of cars with all their properties, but I don't want to tell the controller which cars I want. The controller must check which cars the user,  that is requesting, can see, filter the data list and send only the permitted cars. So user A see only car 1, 2, 5, user B cars 2, 3, 4, 5 and it goes. A car it's not specific to a unique user, it may have multiple users linked to. </p>
  
  <p>I'm using asp.net identity and entity framework </p>
  
  <p>-- edit --</p>
  
  <p>I've been recently searching for and maybe claims could be my solution. But how I use claims to filter data and only bring the items that user has permission?</p>
  
  <p>Please anyone help</p>
  
  <p>-- edit 2 --</p>
  
  <p>I'm adding an example code</p>
  
  <pre><code>public class CarModel
  {
    public int Id { get; set; }
    public string Name { get; set; }
    public DateTime BuildDate { get; set; }
    // and others
  }
  </code></pre>
  
  <p>controller:</p>
  
  <pre><code>public class CarsController
  {
    [Authorize]
    public List&lt;CarModel&gt; GetCars ()
    {
      // get current user permission and return only cars that current user can see
    }
  }
  </code></pre>