AZ305: A condition inheritance can't store

Conditions that limit inheritance, and a link table's where, are worked out once and stored in the tree, so they give the same answer for everyone at any time: not now(), not authz.uid(), and a link table's where reads only that table's columns. Use a column the app sets (archived), or put the time or the user in a permission beside the inheritance.

Reported when the policy is compiled: rowfence check, the editor, rowfence dev.

The mistake

app role app_user
type user = app.users
type folder = app.folders
  owner  : user = owner_id
  parent : folder = parent_id
  can view = owner or (parent.view and {created_at > now() - interval '1 day'})

line 6: {created_at > now() - interval '1 day'} can't limit inheritance: it depends on now, but inherited rights are stored, so the condition must give the same answer for every user at any time [AZ305]

Fixed

app role app_user
type user = app.users
type folder = app.folders
  owner  : user = owner_id
  parent : folder = parent_id
  can view = owner or (parent.view and {not archived})