Support field-level auth control

[ramnivas]

A specific use case:

@access(query = AuthContext.role == "ADMIN" || AuthContext.id == self.id, mutation = AuthContext.role == "ADMIN" || AuthContext.id == self.id)
model User {
  id: Int @pk @autoincrement
  name: String
  membership: Membership?
}

@access(query = AuthContext.role == "ADMIN" || AuthContext.id == self.user.id, mutation = AuthContext.role == "ADMIN" || AuthContext.id == self.user.id)
model Membership {
  id: Int @pk @autoincrement
  kind: String
  user: User
 spouseInfo: String // In real app, more detailed
}

Here we will like users to edit their membership only to the extend of updating the spouseInfo. In other words, users should not be able to assign their membership to another user or change the kind (those must be done by an admin).

Another example:

@access(self.published || AuthContext.role == "admin")
type Concert {
   @pk id ...
   notes: String @auth(AuthContext.role == "admin").
}

Here, notes should be accessible only to "admin"s regardless of if the concert is published.