414 URI Too Long

I'm currently experimenting with an auth proxy that integrates with Supabase and RLS policies. In order to check that the authorization is correct, I am doing two requests on the server:

1. create a Supabase client impersonating the end user and use that to fetch all rows from the table to be synced.
2. Use the IDs of the rows as a parameter for the where clause in the URL to be forwarded to Electric server.

Example code:

```ts
const originUrl = new URL(`http://localhost:3000/v1/shape`);

// Copy over the relevant query params that the Electric client adds
// so that we return the right part of the Shape log.
new URL(req.url).searchParams.forEach((value, key) => {
if ([`live`, `table`, `handle`, `offset`, `cursor`].includes(key)) {
originUrl.searchParams.set(key, value);
}
});

const { data, error } = await supabase
.from("patient_profiles")
.select("id");

originUrl.searchParams.set(
`where`,
` id IN (${data?.map((d) => `'${d.id}'`).join(", ")})`
);

let resp = await fetch(originUrl.toString());
if (resp.headers.get("content-encoding")) {
const headers = new Headers(resp.headers);
headers.delete("content-encoding");
headers.delete("content-length");
resp = new Response(resp.body, {
status: resp.status,
statusText: resp.statusText,
headers,
});
}

return resp;
```
This is the only way I can confidently say that my RLS policies are being enforced all the way down to the end user's browser.

When the user has lots of rows to be returned, a 414 URL Too Long error is returned.

I understand that this is NOT the recommended way to implement security rules, but this issue could actually come up even if I were to rewrite the logic, e.g.

```ts
originUrl.searchParams.set(
`where`,
organization_id IN (${data?.map((d) => `'${d.organization_id}'`).join(", ")}) // What if the user belong to too many organizations?
`
);
```

How should such cases be handled? Can we instead use a `POST` request?