1. Is this filtering after returning results from the database? That seems horribly inefficient in most cases. Most databases should support filtering the data before you return it. Or APIs or whatever.
2. How are these functions now “pure”? I dont think things are magically catchable because you removed some auth logic. It’s just a little simpler to cache, though if the auth logic data doesnt change often it’s not much different.