restrict openapi spec based on sql grants

src/library/PostgREST/Query/SqlFragment.hs

@@ -598,7 +598,32 @@ accessibleTables :: Text -> SQL.Snippet
 accessibleTables schema = SQL.sql (encodeUtf8 [trimming|
   SELECT
     n.nspname AS table_schema,
-    c.relname AS table_name
+    c.relname AS table_name,
+    COALESCE((
+      SELECT array_agg(a.attname ORDER BY a.attnum)
+      FROM pg_attribute a
+      WHERE a.attrelid = c.oid
+        AND a.attnum > 0
+        AND NOT a.attisdropped
+        AND has_column_privilege(c.oid, a.attnum, 'SELECT')
+    ), '{}') AS select_cols,
+    COALESCE((
+      SELECT array_agg(a.attname ORDER BY a.attnum)
+      FROM pg_attribute a
+      WHERE a.attrelid = c.oid
+        AND a.attnum > 0
+        AND NOT a.attisdropped
+        AND has_column_privilege(c.oid, a.attnum, 'INSERT')
+    ), '{}') AS insert_cols,
+    COALESCE((
+      SELECT array_agg(a.attname ORDER BY a.attnum)
+      FROM pg_attribute a
+      WHERE a.attrelid = c.oid
+        AND a.attnum > 0
+        AND NOT a.attisdropped
+        AND has_column_privilege(c.oid, a.attnum, 'UPDATE')
+    ), '{}') AS update_cols,
+    has_table_privilege(c.oid, 'DELETE') AS has_delete
   FROM pg_class c
   JOIN pg_namespace n ON n.oid = c.relnamespace
   WHERE c.relkind IN ('v','r','m','f','p')