{-|
Module      : PostgREST.Query.OpenApi
Description : Types for reflecting the role privileges on the OpenAPI output.
-}
module PostgREST.Query.OpenApi
  ( TableAccess (..)
  , TablesAccess
  , tablesAccessStatement
  , decodeTablesAccess
  ) where

import qualified Data.HashMap.Strict             as HM
import qualified Hasql.Decoders                  as HD
import qualified Hasql.DynamicStatements.Statement as SQL
import qualified Hasql.Statement                 as SQL

import qualified PostgREST.Query.SqlFragment as SqlFragment

import PostgREST.SchemaCache.Identifiers (FieldName, QualifiedIdentifier (..))

import Protolude

-- | Privileges that a role has on a relation, used to reflect them on the OpenAPI output.
data TableAccess = TableAccess
  { taSelectCols :: [FieldName]
  -- ^ columns the role can SELECT
  , taInsertCols :: [FieldName]
  -- ^ columns the role can INSERT into
  , taUpdateCols :: [FieldName]
  -- ^ columns the role can UPDATE
  , taDelete     :: Bool
  -- ^ whether the role can DELETE rows
  }
  deriving (Show, Eq)

type TablesAccess = HM.HashMap QualifiedIdentifier TableAccess

-- | Statement that returns the privileges the current role has on each
-- accessible relation of the given schema.
tablesAccessStatement :: Text -> SQL.Statement () TablesAccess
tablesAccessStatement schema =
  SQL.dynamicallyParameterized (SqlFragment.accessibleTables schema) decodeTablesAccess False

decodeTablesAccess :: HD.Result TablesAccess
decodeTablesAccess =
  let
    row = (,) <$> (QualifiedIdentifier <$> column HD.text <*> column HD.text)
              <*> (TableAccess
                    <$> arrayColumn HD.text
                    <*> arrayColumn HD.text
                    <*> arrayColumn HD.text
                    <*> column HD.bool)
  in
    HM.fromList <$> HD.rowList row

column :: HD.Value a -> HD.Row a
column = HD.column . HD.nonNullable

arrayColumn :: HD.Value a -> HD.Row [a]
arrayColumn = column . HD.listArray . HD.nonNullable