Fix/issue pointer permissions (#4141)

* Makes sure we don't override roles

* Reduces the query size whith pointer permissions

- Does not return as $and if not needed
- Returns just the query with the additional constraint

* Do not use $in if include is just of length 1

src/Controllers/DatabaseController.js

@@ -941,7 +941,14 @@ DatabaseController.prototype.addPointerPermissions = function(schema, className,
       const q = {
         [key]: userPointer
       };
-      return {'$and': [q, query]};
+      // if we already have a constraint on the key, use the $and
+      if (query.hasOwnProperty(key)) {
+        return {'$and': [q, query]};
+      }
+      // otherwise just add the constaint
+      return Object.assign({}, query, {
+        [`${key}`]: userPointer,
+      })
     });
     if (ors.length > 1) {
       return {'$or': ors};