AZ403: An update refinement without an update rule

update after : ... and column rules (update owner_id : ...) add to the table's update rule, which says who may update a row at all. Write it too.

Reported when the policy is compiled: rowfence check, the editor, rowfence dev.

The mistake

app role app_user
type user = app.users
type folder = app.folders
  owner : user = owner_id
  can edit = owner
rules app.folders
  select : edit
  update after : edit

line 8: 'update after' refines updates, so app.folders needs an 'update' rule too [AZ403]

Fixed

app role app_user
type user = app.users
type folder = app.folders
  owner : user = owner_id
  can edit = owner
rules app.folders
  select : edit
  update : edit
  update after : edit