Add composite roles for AND permission checks

[Chehak7]

Summary

• add a canonical Role::allOf() representation for two required roles
• preserve composite roles while parsing, aggregating, and extracting permissions
• validate each component role and keep adapter matching exact
• cover unit behavior and the full adapter matrix

This restores and supersedes #954. It is the database-layer prerequisite for appwrite/appwrite#13317.

Testing

All checks were run inside Docker:

• unit suite: 465 tests, 2,383 assertions
• composite permission adapter test: 16 tests, 80 assertions
• PHPStan level 7: no errors

The complete adapter suite was also started, but the MySQL service stopped responding at 4% with SQLSTATE[HY000]: General error: 2006 MySQL server has gone away; the issue-specific test had already passed against all 16 adapter configurations.

[coderabbitai]

Warning

Review limit reached

Next included review available in 37 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: 01a70870-efff-44d3-878e-0126c0c528f6

📥 Commits

Reviewing files that changed from the base of the PR and between debef42 and 76d7fab.

📒 Files selected for processing (9)

• src/Database/Document.php
• src/Database/Helpers/Permission.php
• src/Database/Helpers/Role.php
• src/Database/Validator/Permissions.php
• tests/e2e/Adapter/Scopes/PermissionTests.php
• tests/unit/DocumentTest.php
• tests/unit/PermissionTest.php
• tests/unit/RoleTest.php
• tests/unit/Validator/PermissionsTest.php

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Greptile Summary

This PR adds a canonical two-role allOf(...) representation and carries it intact through permission parsing, validation, aggregation, document extraction, and exact adapter authorization matching.

• Canonicalizes component ordering and rejects duplicate, nested, or incorrectly sized composites.
• Preserves composite roles when parsing and expanding permissions.
• Validates each component against the existing role grammar.
• Adds unit coverage and shared adapter coverage for exact composite-role matching.

Confidence Score: 5/5

The PR appears safe to merge; no actionable correctness, security, or repository-rule violations were identified.

Composite roles remain canonical and intact across construction, parsing, validation, document extraction, and adapter matching, while malformed components are rejected through the existing validation boundary.

Important Files Changed

Filename	Overview
src/Database/Helpers/Role.php	Adds canonical construction, serialization, parsing, and structural checks for two-role composites.
src/Database/Helpers/Permission.php	Accepts Role objects and preserves composite roles through parsing, getters, and aggregate expansion.
src/Database/Document.php	Extracts complete canonical role strings without stripping composite delimiters.
src/Database/Validator/Permissions.php	Applies the existing role grammar independently to every component of a permission role.
tests/e2e/Adapter/Scopes/PermissionTests.php	Verifies that individual component roles do not satisfy a composite permission and that adapters require the exact composite role.

_{Reviews (1): Last reviewed commit: "feat: add composite permission roles (#1..." | Re-trigger Greptile}