Is it possible to avoid JS.API.STREAM.NAMES request during kv.watch?

[sdkmdsdkmsfmm]

Hello!
My web-app uses JWT token to access a nats server. There are different buckets for each user. I'm trying to limit access to resources.
So my JWT token for user Alice looks like:

`
Pub Allow

$JS.API.INFO

$JS.API.STREAM.INFO.ALICE

$JS.API.CONSUMER.CREATE.ALICE
`

But during kv.watch() and jetStream.subscribe() client makes JS.API.STREAM.NAMES request.
JS.API.STREAM.NAMES works with all streams in account. And there is no way to limit access to streams allowed for user.

There is a "stream" option in JetStreamClientImpl.subscribe (source) method. With that option client doesn't make additional request to find stream. But there's no way to pass that option from kv.watch()

What should I do?
And is it actually good idea to use direct connections from web-app to nats-server? Maybe I shouldn't do it at all and write some backend for frontend proxy

Thanks

[aricart]

Unfortunately, watch() creates a consumer under the covers, which then matches the stream by looking at the subject, thus the call to list the streams, so that means that you cannot really bind to the consumer to observe changes. Streams in general now have a republish option that allows mapping messages, this means that you can use core NATS to learn if there was an update to the KV - of course, this will only work if the client is listening, but on startup, you can learn the current value and then respond to the changes. You can then allow the client to subscribe to the specific keys you want them to be able to observe.

Here's an example https://github.com/nats-io/nats.deno/blob/main/tests/kv_test.ts#L1474