AZ207: Sharing needs a permission

A shared relation is given with authz.share() by someone who holds the type's share permission, or the permission it names: editor : user shared by manage. Declare that permission.

Reported when the policy is compiled: rowfence check, the editor, rowfence dev.

The mistake

app role app_user
type user = app.users
type folder = app.folders
  owner  : user = owner_id
  viewer : user  shared
  can view = owner or viewer

line 5: folder.viewer is shared, which needs a share permission on folder: add `can share = ...` or write `shared by <permission>` [AZ207]

Fixed

app role app_user
type user = app.users
type folder = app.folders
  owner  : user = owner_id
  viewer : user  shared
  can share = owner
  can view  = owner or viewer