docs: public QueryBuilder createQueryFilter() {
      if (userSession.isRoot()) {
        return QueryBuilders.matchAllQuery();
      }
  
      Integer userId = userSession.getUserId();
      BoolQueryBuilder filter = boolQuery();
  
      // anyone
      filter.should(QueryBuilders.termQuery(FIELD_ALLOW_ANYONE, true));
  
      // users
      Optional.ofNullable(userId)
        .map(Integer::longValue)
        .ifPresent(id -> filter.should(termQuery(FIELD_USER_IDS, id)));
  
      // groups
      userSession.getGroups()
        .stream()
        .map(GroupDto::getId)
        .forEach(groupId -> filter.should(termQuery(FIELD_GROUP_IDS, groupId)));
  
      return JoinQueryBuilders.hasParentQuery(
        TYPE_AUTHORIZATION,
        QueryBuilders.boolQuery().filter(filter),
        false);
    }