I tackled this by using SQL as the filter language where the generated code will fill in some context-specific variables like current session user id or current

I tackled this by using SQL as the filter language where the generated code will fill in some context-specific variables like current session user id or current request object id. This is a little limited in this current form and I'm working to expand SQL filters to match up to HTTP codes so you can say this request needs to have a session otherwise it is a 401, then it also needs to match another filter otherwise it is a 403. But this other endpoint is ok to show without a session if the object being requested is marked public in the db. There's a lot to think through especially when extending these filters to bulk methods. https://github.com/eatonphil/dbcore/blob/master/examples/notes/dbcore.yml https://github.com/eatonphil/dbcore/blob/master/examples/not...