restrict openapi spec based on sql grants

src/library/PostgREST/Query/OpenApi.hs

@@ -0,0 +1,29 @@
+{-|
+Module      : PostgREST.Query.OpenApi
+Description : Types for reflecting the role privileges on the OpenAPI output.
+-}
+module PostgREST.Query.OpenApi
+  ( TableAccess (..)
+  , TablesAccess
+  ) where
+
+import qualified Data.HashMap.Strict as HM
+
+import PostgREST.SchemaCache.Identifiers (FieldName, QualifiedIdentifier)
+
+import Protolude
+
+-- | Privileges that a role has on a relation, used to reflect them on the OpenAPI output.
+data TableAccess = TableAccess
+  { taSelectCols :: [FieldName]
+  -- ^ columns the role can SELECT
+  , taInsertCols :: [FieldName]
+  -- ^ columns the role can INSERT into
+  , taUpdateCols :: [FieldName]
+  -- ^ columns the role can UPDATE
+  , taDelete     :: Bool
+  -- ^ whether the role can DELETE rows
+  }
+  deriving (Show, Eq)
+
+type TablesAccess = HM.HashMap QualifiedIdentifier TableAccess