Your GET /docs/:id has a permission check. Does GET /docs?

Most apps I've looked at guard single-object routes fine. You fetch the document, check the user can...