The components returned filters the unauthorized ones whereas the total does not.
It's possible to have a response similar to the extract below.
The problem highlights some strong limitations with the current implementation:
- pagination is applied before filtering out unauthorized components (bug)
- it is not possible to count only authorized component
- performance are not good if searching for files with a great page size (no hard limitation)
It should rely on the ES component index which provides out of the box:
- fast response
- pagination with 'Browse' permission