Relations in query and possible way to filter

i have a relation between users and orders (a user can have many orders)
on my backendthe data looks correct (when i see an order it shows me the user it belongs, when i see a user it shows me the orders owned by the user)
I set the the roles for authenticated user as Order find and findOne and User me
On my front end i am able to login and make authenticate requests
But when i query orders, it returns me all the orders (including the one that i dont own) but the return data is missing the relation field.
im querying the API with axios passing the Authentication in header, but its seems im not able to get back the relation. Also i would like to filter out the not needed data before getting it back; let’s assume i have thousand of orders, but the user that is logged in got only 3, i would need to get the 3 he has, instead that all the 1000 and then filter them out
hope it make sense!

Thank you