Using Ownership User Policies to secure Resource Endpoint with KeyCloak

I'm working on an issue tracking system API I'm securing with Keycloak.

I've created the following roles: User, Admin, & Agent. These roles are good for UI page access and core admin endpoints but the problem I'm facing is distinguishing User Ownership. Right now using only basic roles, any User can edit any User's ticket.

Here's what I'm trying to do:

• RESOURCE - /api/v1/tickets/{id}/update

• DESIRED POLICY - Only the User role who created the ticket (owner) or Admin role can edit

The API is using Node.js & the Keycloak client is 'confidential' with Authentication enabled.

My endpoint's Keycloak intercept looks like this.

router.post('/tickets/:id/update', keycloack.protect(['user', 'admin']), ticketCtrl.update)

I could write a helper method to check based on the ticketId & Keycloak userIdToken from the Auth token I suppose.

Pseudo Method *

isTicketOwner = () => (req, res, next) => {
    let ticketId = req.params.id;
    let userIdToken = parseJwt(req.header.authentication).userIdToken;
    let query = tickets.find({ id: ticketId, userId: userIdToken });
    return query.length ? next() : res.status(401).send('Unauthorized');
}

But ideally, I would like Keycloak to handle this validation and avoid additional DB calls. When I create a ticket I need a way to establish User ownership of the resource to Keycloak.

Can anyone recommend a sensible approach?