    async def post(self, user_name, server_name=None):
        """POST grants permissions for a given server"""

        if server_name is None:
            # only GET supported `/shares/{user}` without specified server
            raise web.HTTPError(405)

        model = self.get_json_body() or {}
        try:
            request = ShareGrantRequest(**model)
        except ValidationError as e:
            raise web.HTTPError(400, str(e))

        scopes = request.scopes
        # check scopes
        if not scopes:
            # default scopes
            scopes = [f"access:servers!server={user_name}/{server_name}"]

        # validate that scopes may be granted by requesting user
        try:
            scopes = orm.Share._apply_filter(frozenset(scopes), user_name, server_name)
        except ValueError as e:
            raise web.HTTPError(400, str(e))

        # resolve target spawner
        spawner = self._lookup_spawner(user_name, server_name)

        # check permissions
        for scope in scopes:
            if not self.has_scope(scope):
                raise web.HTTPError(
                    403, f"Do not have permission to grant share with scope {scope}"
                )

        if request.user:
            scope = f"read:users:name!user={request.user}"
            if not self.has_scope(scope):
                raise web.HTTPError(
                    403, "Need scope 'read:users:name' to share with users by name"
                )
            share_with = self.find_user(request.user)
            if share_with is None:
                raise web.HTTPError(400, f"No such user: {request.user}")
            share_with = share_with.orm_user
        elif request.group:
            if not self.has_scope(f"read:groups:name!group={request.group}"):
                raise web.HTTPError(
                    403, "Need scope 'read:groups:name' to share with groups by name"
                )
            share_with = orm.Group.find(self.db, name=request.group)
            if share_with is None:
                raise web.HTTPError(400, f"No such group: {request.group}")

        share = orm.Share.grant(self.db, spawner, share_with, scopes=scopes)
        self.finish(json.dumps(self.share_model(share)))
POST grants permissions for a given server
jupyterhub/apihandlers/shares.py