AZ301: Following a relation that can't be followed

relation.name follows a relation to the objects it links to and asks for their relation or permission: parent.view, org.member. Only relations to objects can be followed: not a permission, and not a relation to groups (team#member), anyone or link. And a relation to objects is not a set of users: follow it (parent.view), don't use it alone.

Reported when the policy is compiled: rowfence check, the editor, rowfence dev.

The mistake

app role app_user
type user = app.users
type folder = app.folders
  owner  : user = owner_id
  parent : folder = parent_id
  can view = owner or parent

line 6: folder.parent links to folder objects, not users; follow it with a dot, e.g. parent.view [AZ301]

Fixed

app role app_user
type user = app.users
type folder = app.folders
  owner  : user = owner_id
  parent : folder = parent_id
  can view = owner or parent.view