My question is about when it's OK to merge separate models into one single REST resource and whether this leads to tricky and difficult to work with design, down the line.
Let's say I have a movie streaming service and users can only watch movie genres they have permissions for. Let's say these are represented with these hypothetical models:
users (id)
movie_genres (id, genre_name)
users_to_genres_permissions (id, genre_id, user_id)
exposed through REST routes /users
/movie_genres
and /users_to_genres_permissions
Now, as a user client of this API (think a website or a mobile app), in order to find out what genres I'm allowed to get hold of, I would fetch the genres permissions and then all the movie genres. Two network calls.
However, an argument could be made that having to make multiple round-trips to the API is inefficient, and you additionally have to deal with a bunch of joins on the client. This example is simple enough with its 3 relations, but in the real world you could have much longer chains.
Thus one could consider collapsing two models into one, and for example return permissions already joined to movie genres:
movie_genres (id, genre_name, authorized_for_current_user)
However the question is, this thought process can be taken pretty far. You could save the client a lot of joins and round-trips by doing all joining on the server. However, at what point do you stop? At what point is what you returning no longer a REST resources but a generic blob of data that's been concatenated together?
Is there a rule of thumb for deciding where to draw the line?