feat: add openapi-mode config (#1881)

* openapi-mode="follow-acl"(default): follows access control for the
JWT role.
* openapi-mode="ignore-acl": ignores access control for the JWT role.
* openapi-mode="disabled": disables OpenAPI output, the root endpoint
replies with 404 Not Found.

test/Feature/DisabledOpenApiSpec.hs

@@ -0,0 +1,20 @@
+module Feature.DisabledOpenApiSpec where
+
+import Network.HTTP.Types
+import Network.Wai        (Application)
+
+import Test.Hspec     hiding (pendingWith)
+import Test.Hspec.Wai
+
+import Protolude
+
+spec :: SpecWith ((), Application)
+spec =
+  describe "Disabled OpenApi" $ do
+    it "does not accept application/openapi+json and responds with 415" $
+      request methodGet "/"
+        [("Accept","application/openapi+json")] "" `shouldRespondWith` 415
+
+    it "accepts application/json and responds with 404" $
+      request methodGet "/"
+        [("Accept","application/json")] "" `shouldRespondWith` 404

test/Feature/IgnoreAclOpenApiSpec.hs

@@ -0,0 +1,43 @@
+module Feature.IgnoreAclOpenApiSpec where
+
+import Control.Lens ((^?))
+
+import Data.Aeson.Lens
+import Data.Aeson.QQ
+
+import Network.HTTP.Types
+import Network.Wai        (Application)
+import Network.Wai.Test   (SResponse (..))
+
+import Test.Hspec     hiding (pendingWith)
+import Test.Hspec.Wai
+
+import Protolude  hiding (get)
+import SpecHelper
+
+spec :: SpecWith ((), Application)
+spec = describe "OpenAPI Ignore ACL" $ do
+  it "root path returns a valid openapi spec" $ do
+    validateOpenApiResponse [("Accept", "application/openapi+json")]
+    request methodHead "/" (acceptHdrs "application/openapi+json") ""
+      `shouldRespondWith` "" { matchStatus  = 200 }
+
+  describe "table" $ do
+
+    it "includes privileged table even if user does not have permission" $ do
+      r <- simpleBody <$> get "/"
+      let tableTag = r ^? key "paths" . key "/authors_only"
+                     . key "post" . key "tags"
+                     . nth 0
+
+      liftIO $ tableTag `shouldBe` Just [aesonQQ|"authors_only"|]
+
+  describe "RPC" $ do
+
+    it "includes privileged function even if user does not have permission" $ do
+      r <- simpleBody <$> get "/"
+      let funcTag = r ^? key "paths" . key "/rpc/privileged_hello"
+                    . key "post" . key "tags"
+                    . nth 0
+
+      liftIO $ funcTag `shouldBe` Just [aesonQQ|"(rpc) privileged_hello"|]