Mongodb - Users, roles and groups with JWT + REST API - mongodb

Question

Intro
I am implementing simple MEAN app with JWT token for auth. This app allows you to create account and then create your own group or join existing one. Each group have specific roles that group administrator assign to each user. Here is my Schemas, that will hopefully help you better understand my solution.
User schema
_id: {
type: String,
default: function () { return new mongo.ObjectId().toString() }
},
email: {
type: String,
required: true,
unique: true
},
displayName: {
type: String
},
hash: {
required: true,
type: String
}
Group schema
_id: {
type: String,
default: function () { return new mongo.ObjectId().toString() }
},
groupName: String,
ownerUser: {
type: String,
ref: 'User'
},
userList: [
{
user: {
type: String,
ref: 'User'
},
role: {
type: String,
ref: 'Role'
}
}
]
Role schema
_id: {
type: String,
default: function () { return new mongo.ObjectId().toString() }
},
groupId: String,
roleName: String,
access: [{
path: String,
allowed: Boolean
}]
How it works
User register/login -> Create group or join existing one -> Group admin assign role to user.
Groups will have approximately 250 users.
Group could have multiple roles (10-15).
User can join multiple groups
Express part
example route
router.get('/restricted', JWTAuth, userProject, userRole, (res, req, next) => {
res.send("ok")
})
access.js
export const JWTAuth = passportAuth('jwt', {session: false});
export const userProject = async (req, res, next) => {
const userProject = await GroupModel.findOne({ _id: req.body.groupId, "userList.user" : req.user._id })
if(userProject) {
req.project = userProject;
next()
}else{
res.sendStatus(401);
}
}
export const userRole = async (req, res, next) => {
const roleId = arrayFindByObjectValue(req.user._id, 'user', req.project.userList).role;
const userRole = await RoleModel.findOne({ _id: roleId })
req.role = userRole;
next();
}
export const arrayFindByObjectValue = (value, key, array) => {
for (var i = 0; i < array.length; i++) {
if (array[i][key] === value) {
return array[i];
}
}
}
other tries..
populate (any improvements at speed)
export const userRolePopulate = async (req, res, next) => {
const userProject = await GroupModel.findOne({ _id: req.body.groupId, "userList.user" : req.user._id }, {"userList.$" : 1}).populate('userList.role');
req.role = userProject.userList[0].role;
next()
}
and aggregation (15% improvement)
const userProject: any = await GroupModel.aggregate([
{$match: {_id: req.body.groupId}},
{$project: {
userList: {$filter: {
input: '$userList',
as: 'user',
cond: {$eq: ['$$user.user', req.user._id]}
}},
_id: 0
}},
])
Question
Now I hope you understand my situation. With this approach I have to do multiple db queries to get user role just for simple request. I am worried about the speed. Each request took around 150 ms more with role middleware (1000 Group users). I think this solution will unnecessarily overloads the server. Is there better solution? Should I use some session(stateless JWT..) or other method to temporary store user role? Is there better database design for this method?
I read a lot of articles about role based systems, but I have never came across this specific solution. Thank you for your answers. If you need more informations please let me know and I will edit my answer.