[littlegrasscao]

Summary

• add the USE_SHARE privilege, checked through CatalogConnector#authorize like CREATE_SHARE
• GET /shares lists every share for a caller with USE_SHARE, and only the caller's own shares otherwise; paging works the same either way
• GET /shares/{share} and GET /shares/{share}/permissions need the caller to own the share or hold USE_SHARE; otherwise they return 403 PERMISSION_DENIED
  • the owner reads their own shares without a catalog call
• the local catalog gives each principal a privileges list and refuses privileges outside it; a principal without the list holds none
• the sample local-catalog.yml lists CREATE_SHARE, CREATE_RECIPIENT and USE_SHARE for alice and bob, so earlier tests keep passing, and adds carol, who holds only CREATE_SHARE and CREATE_RECIPIENT

Testing

• mvn clean install: 123 tests passed
• ShareReadPrivilegeTest:
  • carol, without USE_SHARE, lists only her own share, while bob, who holds USE_SHARE, lists both alice's and carol's
  • carol can get her own share and its permissions, but gets 403 for alice's; bob can read carol's