Check user permissions in RESTful API

I'm developing a SaaS API with NodeJS, Express, MongoDB. It has implemented a JWT authentication/security methodology.

In my personal case, I have (for now) two collections: User and Client.

You can see the fields that each collection has (for defining purposes). So in terms of endpoint design I'm using a trully restful approach so:

• /api/users/{userId}/clients: to insert clients i.e.

This is exactly the point I'm bringing I want, that before posting a new client to check if the price plan allows the user to do that. In terms of logic:

function post(req,res){
    // Check if the JWT user.id is the same of the endpoint request
    if(req.user._id == req.params.id){ 
       // Here I want to know which is the price plan and to count the Clients that the user has

   }
}

In terms of my doubts I have thought in some hypothesis but I truly don't know which one is the best:

• Do a query in the User collection get the price plan, do a query count on the Clients collection validate and then post the new Client.
• Put the User's price plan information in the JWT, do a query count on the user's Clients collection validate and then post the new Client.

These are the two main possible solutions I thought about, but I have serious doubts security and performance wise of which one I should implement/follow.

Thank you in advance.

via Ricardo