AZ209: A group made only of itself

A group's members may include other groups' members (team#member), but something must bring in users, or the group is always empty.

Reported when the policy is compiled: rowfence check, the editor, rowfence dev.

The mistake

app role app_user
type user = app.users
type team = app.teams
  owner  : user = owner_id
  member : team#member  shared by manage
  can manage = owner or member

line 5: team.member only contains itself; add a source of users [AZ209]

Fixed

app role app_user
type user = app.users
type team = app.teams
  owner  : user = owner_id
  member : user, team#member  shared by manage
  can manage = owner or member