rowfence

Appearance

AZ203: A relation or permission that isn't there ​

An expression, a type#relation subject, shared by, custom roles, a scope or a test names a relation or permission the type doesn't have. The message lists what it has; declare the missing one, or fix the name.

Reported when the policy is compiled: rowfence check, the editor, rowfence dev.

The mistake ​

authz
app role app_user
type user = app.users
type folder = app.folders
  owner : user = owner_id
  can view = owner or viewer
line 5: folder has no relation or permission 'viewer' (it has: owner, view) [AZ203]

Fixed ​

authz
app role app_user
type user = app.users
type folder = app.folders
  owner  : user = owner_id
  viewer : user = app.folder_viewers(folder_id -> user_id)
  can view = owner or viewer