Fix authorization errors reversing current and allowed roles

[HarshMN2345]

Denied authorization messages identified the last allowed role as the caller, then reversed the current and allowed role lists. Report the caller’s complete role list and the resource’s allowed roles in the correct positions. Permission checks themselves are unchanged.

The regression covers multiple allowed roles, a guest caller, and a caller with no roles. It fails against the original implementation and passes with the fix. Focused authorization tests pass (three tests, 30 assertions), as do Pint and targeted PHPStan level 7. On commit b56a4da, GitHub CI passed the full unit suite (470 tests, 2,412 assertions), all 16 adapter lanes, Linter, and CodeQL. Shared adapter assertions also verify the corrected diagnostics for document updates and relationship permissions.

Addresses appwrite/appwrite#7201.

Appwrite must adopt a released package version to receive this change.

Summary by CodeRabbit

• Bug Fixes
  • Authorization error messages now accurately list all roles that are allowed and identify the roles missing the required permission.
  • Updated messages use consistent role-based wording across document, relationship, and nested resource authorization checks.
  • Error descriptions now remain accurate when multiple roles are involved or when no roles are provided.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 5571aab0-9b7b-4a6c-9272-763697d87f96

📥 Commits

Reviewing files that changed from the base of the PR and between 64f5257 and b56a4da.

📒 Files selected for processing (4)

• src/Database/Validator/Authorization.php
• tests/e2e/Adapter/Scopes/DocumentTests.php
• tests/e2e/Adapter/Scopes/RelationshipTests.php
• tests/unit/Validator/AuthorizationTest.php

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

Authorization denial descriptions now list denied and allowed roles as arrays. Unit and end-to-end tests verify the updated messages for authorization and document relationship operations.

Changes

Authorization denial messages

Layer / File(s)	Summary
Authorization message format and unit coverage src/Database/Validator/Authorization.php, tests/unit/Validator/AuthorizationTest.php	Authorization::isValid() now reports all provided roles and uses the “roles are allowed” wording. Unit tests cover denied execute and read permissions.
Document permission error coverage tests/e2e/Adapter/Scopes/DocumentTests.php, tests/e2e/Adapter/Scopes/RelationshipTests.php	End-to-end assertions now verify the complete role-array error messages for root, nested, and multi-level nested document operations.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Suggested reviewers: abnegate

Merge Risk: ⚪ Minimal · up to b56a4

The authorization diagnostics match the intended role ordering and array format, with no remaining merge-blocking risk identified.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 40.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 5 functions across 4 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the main change: correcting authorization error messages that reversed the current and allowed roles.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/fix-authorization-error-roles

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge because it corrects only the denial diagnostic and preserves authorization decisions.

Summary

• Reports the caller’s complete active role list before the resource’s allowed roles.
• Removes the misleading singular role and scopes wording.
• Covers multiple allowed roles, guest context, empty caller roles, document updates, and relationship permissions.

_{Reviews (1) · Last reviewed commit: "Update adapter expectations for correcte..."}