I think it probably does make sense to extract these filters, this was actually done in https://github.com/jlsherrill/katello/commit/1d8d900549d1402b0c4124353351f8a53f890162#diff-e3b4a100c3808d51e9a50f928ab4bc8dR234   based on PR feedback due to the amount of logic in in.  So i'm all for a discussion about the best place to put this.  I could see the authorization layer or the glue/elasticsearch layer.