Best approach for handling users (creating, user attributes & querying)

I found out appwrite is wayy different to supabase, so i just wanted to check my approach is correct.

Normally when creating user, I'd have something like a trigger on auth.users table to create public.profile table and i'd put any information I want about user there.

In appwrite, I found out there are preferences, but saw they are not Query-able, is that correct?

I use OAuth. So on sign-up/sign-in, do I just check if there's existing document in custom profiles collection, and create it client-side if not - is that the "correct"/best practice approach?

Also, I want to query all users based on 1 specific attribute (available days) and is_premium flag (which should be set by RevenueCat's webhook): How do I make sure user can't change is_premium attribute (attribute level permission)?

Also, I noticed there's no support for auth realtime streams - something like Stream<User?> authStateChanges();. Is it on the roadmap? I think it's very important. Not sure if my approach of identifying and resetting user identities in all SDKs (revenuecat,sentry,posthog,...) on login() and logout() is sufficient, cuz what if user gets logged out even without clicking log out? etc.

@Kenny hope you don't mind me tagging you, i remember you helped me a lot last time

I would setup a cloud function that uses the event user.create and have that create a record in your profiles collection.

I would make a collection not editable by a user and populate it via server side, like a cloud function.