What we're doing in our production version of this is using Postgres and Hasura for auth following this approach in order to reduce external dependencies: https://github.com/sander-io/hasura-jwt-auth

It's really amazing how far you can get with just Postgres. Writing business logic with code in application middleware always felt hacky to me when we have these powerful and performant relation databases.