so you probably need to restrict the set of product_ids with a filter of just the products the user can actually read