Add more constraints to my controllers list method

Add more constraints to my controllers list method

At the moment my controllers list method for the domain object Product is:
def list(Integer max) {
params.max = Math.min(max ?: 10, 100)
[productInstanceList: Product.list(params), productInstanceTotal:
Product.count()]
}
I wish to add more constrains to this. More specifically, I want to get
the logged in user. This has a M:1 relationship to a domain entity called
Manager. Manager has a M:M relationship to domain entity Company. Company
has a 1:M relationship to Product. So I want to only return products that
are from the appropriate company.
I start by doing:
def list(Integer max) {
// 1. Get logged in user.
def user = springSecurityService.currentUser;
// 2. Get corresponding manager.
Manager mgr = user.getManager();
// 3. Get corresponding companies
companies = mgr.getCompanies();
// 4. Get products for all companies - not sure smart way to get this.
// 5. Need to add the products to the query
...
}
As can be seen I get stuck at steps 4, 5. Using raw SQL I would just to a
join to represent to all the User's Manager's Companies' Products and then
put this in as a where predicate and hit the product table.
But I want a grails / groovy solution. I also need to keep the params in
the query as this controller can also have params injected which are pass
into the query,
Any tips?