Function assertCallerMayCreateShare

Server-side gate for CREATING a new share. Blocks users who hold role-level CanCreate on a sharing entity but don't own the target resource and don't already hold a Share-capable grant on it.

Separate from checkShareManagePermission (which handles Update/Delete) because Angular's default role-based check can't express "the caller owns the underlying resource" — that requires a resource-specific lookup.

Usage in an extended entity's Save() override:

const isNewShare = !this.IsSaved;
if (!assertCallerMayCreateShare(this, isNewShare, () => this.callerIsAuthorizedToShare())) {
    return false; // save is short-circuited; LatestResult carries the reason
}
const saved = await super.Save(options);
Copy

Returns true when the save should proceed, false to short-circuit. On false, sets entity.LatestResult with Success=false and a user-visible Message, and emits a LogError for server logs.

Short-circuits to true (allows the save) when:

• isNewShare is false (not a create — Update/Delete handled by CheckPermissions)
• provider is not the Database provider (client-side save, already trusted)
• entity.ContextCurrentUser is missing (defer to downstream auth layers)