instead of select * inspect schema to get selectable columns

test/spec/Feature/Query/DeleteSpec.hs

@@ -120,9 +120,12 @@ spec withConfig = withConfig baseCfg $
           }
 
     context "table with limited privileges" $ do
-      it "fails deleting the row when return=representation and selecting all the columns" $
+      it "succeeds deleting the row when return=representation and selecting all columns, returning only the privileged columns" $
         request methodDelete "/app_users?id=eq.1" [("Prefer", "return=representation")] mempty
-            `shouldRespondWith` 401
+            `shouldRespondWith` [json|[ { "id": 1, "email": "test@123.com" } ]|]
+            { matchStatus  = 200
+            , matchHeaders = ["Content-Range" <:> "*/*"]
+            }
 
       it "succeeds deleting the row when return=representation and selecting only the privileged columns" $
         request methodDelete "/app_users?id=eq.1&select=id,email" [("Prefer", "return=representation")]

test/spec/Feature/Query/InsertSpec.hs

@@ -720,11 +720,10 @@ spec withConfig = withConfig baseCfg $ do
         , matchHeaders = []
         }
 
-    it "fails inserting if select is not specified" $
+    it "succeeds inserting if select is not specified, returning only the accessible columns" $
       request methodPost "/limited_article_stars" [("Prefer", "return=representation")]
-        [json| {"article_id": 3, "user_id": 1} |] `shouldRespondWith`
-      [json|{"hint":null,"details":null,"code":"42501","message":"permission denied for view limited_article_stars"}|]
-        { matchStatus  = 401
+        [json| {"article_id": 3, "user_id": 1} |] `shouldRespondWith` [json|[{"article_id":3,"user_id":1}]|]
+        { matchStatus  = 201
         , matchHeaders = []
         }
 

test/spec/Feature/Query/QuerySpec.hs

@@ -36,6 +36,19 @@ spec actualPgVersion withConfig = withConfig baseCfg $ do
       , matchHeaders = ["Content-Length" <:> "120"]
       }
 
+  describe "Column-level privileges" $ do
+    it "selects only the accessible columns when no select is specified" $
+      get "/app_users?id=eq.1"
+        `shouldRespondWith`
+        [json| [{"id":1,"email":"test@123.com"}] |]
+        { matchStatus = 200 }
+
+    it "can still select the accessible columns explicitly" $
+      get "/app_users?id=eq.1&select=id,email"
+        `shouldRespondWith`
+        [json| [{"id":1,"email":"test@123.com"}] |]
+        { matchStatus = 200 }
+
   describe "Filtering response" $ do
     it "matches with equality" $
       get "/items?id=eq.5"