anchor.diff:  -type allowed_paths() :: all | [file_meta:path()].
   -type allowed_guids() :: all | [[file_id:file_guid()]].
   
  +-type relation_ctx() ::
  +    {subpath, file_ctx:ctx()} |
  +    {ancestor, file_ctx:ctx(), children_list()}.
  +
  +-export_type([relation_ctx/0]).
  +
   
   %%%===================================================================
   %%% API
  
positive.code: ensure_authorized(
      UserCtx, FileCtx0, AccessRequirements, AllowAncestorsOfPaths
  ) ->
      {_, FileCtx1} = check_data_and_cache_constraints(
          UserCtx, FileCtx0, AllowAncestorsOfPaths
      ),
      fslogic_access:assert_granted(UserCtx, FileCtx1, AccessRequirements).
  
  
  %%--------------------------------------------------------------------
  
negative.code: %%--------------------------------------------------------------------
  %% @doc
  %% Checks access to specified file and verifies data caveats.
  %% AllowAncestorsOfPaths means that permission can be granted not only
  %% for files in subpaths allowed by caveats but also for their ancestors.
  %% @end
  %%--------------------------------------------------------------------
  -spec ensure_authorized(user_ctx:ctx(), file_ctx:ctx(),
  