title: strapi - restrict user to fetch only data related to him
body: <p>Usually, a logged-in user gets all entries of a Content Type. </p>
  
  <p>I created a "snippets" content type <code>(_id,name,content,users&lt;&lt;-&gt;&gt;snippets)</code></p>
  
  <p><code>&lt;&lt;-&gt;&gt;</code> means "has and belongs to many" relation. </p>
  
  <p>I created some test users and make a request:
  <code>
  curl -H 'Authorization: Bearer eyJ...'  http://localhost:1337/snippets/
  </code></p>
  
  <p>Main Problem: an authenticated user should only see the entries assigned to him. Instead, a logged-in user gets all snippets, which is bad.</p>
  
  <p>How is it possible to modify the <code>fetchAll(ctx.query);</code> query to take that into account so it does something like <code>fetchAll(ctx.state.user.id);</code> at the <code>/</code>-route-><code>find</code>-method ?</p>
  
  <p>The basic find method is here:</p>
  
  <pre><code>find: async (ctx) =&gt; {
  
      if (ctx.query._q) {
        return strapi.services.snippet.search(ctx.query);
      } else {
        return strapi.services.snippet.fetchAll(ctx.query);
      }
  },
  </code></pre>
  
  <p>Sub-Question: Does strapi even know which user is logged in when I do Bearer-Token Authentication ?</p>