I need to create a user in PostgreSQL with the least privileges possible. So, the user would only be allowed to do queries on specific tables and views. That user should not be allowed to get any additional info, especially not see the view definitions. How can this be done?
You cannot hide the view definition from the user without modifying the database metadata in a way that will break things. But it is no problem to show the user the view definition.
What is more important is to define the view with
security_barrier = true so that the user cannot use functions with side effects to get at the underlying tables.
If you want to hide the query used to extract the data, your best choice might be to write a C function that produces the data. If the user has no access to the database server, that should be safe.