Integrating Vapor and React
So after some work the answer to my question is c.
I have two separate projects:
1) One using Vapor to build a pure restful service that responds to GET and POST requests with JSON responses. It handles all the security assuming the browser is insecure.
2) Then on the front end, I have a React single page app. It downloads a user's permissions during logon, and uses this to control what is visible on screen.
The server ensures that no data is ever sent or persisted that is outside a user's permissions. Therefore if a user was able to try and see a page in the React app that they didn't have permission to, they would only see the page structure and no data.
Coming back to this...I have written an intro tutorial for this on my site, here: https://www.vaporforums.io/thread/25
But essentially, use 2 separate projects, and use the front end to make API requests to the backend.