src/Appwrite/Platform/Modules/Functions/Http/Variables/Delete.php (1)

80-82: Remove duplicate empty check.

Lines 76–78 already verify that $variable is not empty (among other conditions). This second empty check is unreachable and can be safely removed.

Apply this diff:

-        if ($variable === false || $variable->isEmpty()) {
-            throw new Exception(Exception::VARIABLE_NOT_FOUND);
-        }
-

src/Appwrite/Platform/Modules/Functions/Http/Functions/Deployment/Update.php (1)

114-120: Verify if the nested skip() call is necessary.

The updateDocument operation on line 119 is already wrapped in a skip() call on line 114 that encompasses the entire foreach operation. The inner skip() on line 119 appears redundant, as authorization should already be bypassed within the outer closure's scope.

Please verify whether the nested skip is necessary or if the inner call can be removed.

If the inner skip is confirmed redundant, apply this diff:

 $dbForPlatform->getAuthorization()->skip(fn () => $dbForPlatform->foreach('rules', function (Document $rule) use ($dbForPlatform, $deployment) {
     $rule = $rule
         ->setAttribute('deploymentId', $deployment->getId())
         ->setAttribute('deploymentInternalId', $deployment->getSequence());
 
-    $dbForPlatform->getAuthorization()->skip(fn () => $dbForPlatform->updateDocument('rules', $rule->getId(), $rule));
+    $dbForPlatform->updateDocument('rules', $rule->getId(), $rule);
 }, $queries));

docker-compose.yml (1)

92-92: Guard the vendor source mount behind a compose profile.

Great for iterating on utopia-php/database locally, but it can mismatch composer’s installed version. Recommend enabling this only under a dedicated profile to avoid accidental use outside dev.

Example:

 appwrite:
   volumes:
@@
-  - ./vendor/utopia-php/database/src:/usr/src/code/vendor/utopia-php/database/src
+  # Enable only when hacking on utopia-php/database
+  - ./vendor/utopia-php/database/src:/usr/src/code/vendor/utopia-php/database/src
+    # profiles:
+    #   - hack-db

Then run with: docker compose --profile hack-db up.

Please confirm this file isn’t used in any CI or prod-like environment.

src/Appwrite/Platform/Modules/Functions/Http/Variables/Update.php (1)

106-112: Guard schedule update when schedule is absent.

Updating the platform schedule without ensuring scheduleId exists and the doc is present can fail.

- $schedule = $dbForPlatform->getDocument('schedules', $function->getAttribute('scheduleId'));
- $schedule
-     ->setAttribute('resourceUpdatedAt', DateTime::now())
-     ->setAttribute('schedule', $function->getAttribute('schedule'))
-     ->setAttribute('active', !empty($function->getAttribute('schedule')) && !empty($function->getAttribute('deploymentId')));
- $dbForPlatform->getAuthorization()->skip(fn () => $dbForPlatform->updateDocument('schedules', $schedule->getId(), $schedule));
+ $scheduleId = $function->getAttribute('scheduleId');
+ if (!empty($scheduleId)) {
+     $schedule = $dbForPlatform->getDocument('schedules', $scheduleId);
+     if (!$schedule->isEmpty()) {
+         $schedule
+             ->setAttribute('resourceUpdatedAt', DateTime::now())
+             ->setAttribute('schedule', $function->getAttribute('schedule'))
+             ->setAttribute('active', !empty($function->getAttribute('schedule')) && !empty($function->getAttribute('deploymentId')));
+         $dbForPlatform->getAuthorization()->skip(
+             fn () => $dbForPlatform->updateDocument('schedules', $schedule->getId(), $schedule)
+         );
+     }
+ }

Please confirm scheduleId is always set when variables change; if guaranteed, we can downgrade this to a no‑op.

src/Appwrite/Platform/Tasks/StatsResources.php (1)

63-66: Configure authorization once and use a single reference.

Move disable() and setDefaultStatus(false) outside the loop (or guard with a one‑time flag) and consistently use $this->dbForPlatform inside the closure to avoid mixed references.

-        Console::loop(function () use ($queue, $dbForPlatform) {
-            $dbForPlatform->getAuthorization()->disable();
-            $dbForPlatform->getAuthorization()->setDefaultStatus(false);
+        // Configure auth once
+        $this->dbForPlatform->getAuthorization()->disable();
+        $this->dbForPlatform->getAuthorization()->setDefaultStatus(false);
+        Console::loop(function () use ($queue) {

src/Appwrite/Platform/Modules/Tokens/Http/Tokens/Buckets/Files/Action.php (1)

24-26: Auth check looks good; consider consistent permission access.

Optional: use getPermissionsByType(Database::PERMISSION_READ) for consistency with other modules.

- if (!$dbForProject->getAuthorization()->isValid(new Input(Database::PERMISSION_READ, $bucket->getRead()))) {
+ if (!$dbForProject->getAuthorization()->isValid(
+        new Input(Database::PERMISSION_READ, $bucket->getPermissionsByType(Database::PERMISSION_READ))
+    )) {

src/Appwrite/Platform/Modules/Tokens/Http/Tokens/Buckets/Files/Create.php (1)

81-85: Return auth description on 401 and align permission accessor.

Improve error context and consistency with sibling Action:

- $bucketPermission =  $dbForProject->getAuthorization()->isValid(new Input(Database::PERMISSION_UPDATE, $bucket->getUpdate()));
+ $bucketPermission = $dbForProject->getAuthorization()->isValid(
+     new Input(Database::PERMISSION_UPDATE, $bucket->getPermissionsByType(Database::PERMISSION_UPDATE))
+ );
@@
- $filePermission = $dbForProject->getAuthorization()->isValid(new Input(Database::PERMISSION_UPDATE, $file->getUpdate()));
+ $filePermission = $dbForProject->getAuthorization()->isValid(
+     new Input(Database::PERMISSION_UPDATE, $file->getPermissionsByType(Database::PERMISSION_UPDATE))
+ );
@@
-            if (!$bucketPermission && !$filePermission) {
-                throw new Exception(Exception::USER_UNAUTHORIZED);
-            }
+            if (!$bucketPermission && !$filePermission) {
+                throw new Exception(Exception::USER_UNAUTHORIZED, $dbForProject->getAuthorization()->getDescription());
+            }
@@
-        } elseif (!$bucketPermission) {
-            throw new Exception(Exception::USER_UNAUTHORIZED);
+        } elseif (!$bucketPermission) {
+            throw new Exception(Exception::USER_UNAUTHORIZED, $dbForProject->getAuthorization()->getDescription());
         }

Also applies to: 88-90

src/Appwrite/Platform/Modules/Databases/Http/Databases/Transactions/Update.php (2)

145-150: Avoid unbounded scans; consider chunking.

Query::limit(PHP_INT_MAX) and fetching database/collection metadata inside the main loop can be heavy on large transactions. Prefer paging logs (e.g., batched find with cursor/limit) and prefetching required metadata into a local cache keyed by internal IDs.

Also applies to: 286-293

---

233-261: Deduplicate repeated “set status=failed” updates.

The same updateDocument('transactions', ..., ['status' => 'failed']) appears in multiple catch blocks. Extract a small helper/closure to reduce duplication and chances of drift.

tests/e2e/Services/Databases/TablesDB/Permissions/DatabasesPermissionsGuestTest.php (1)

20-28: Cache the Authorization instance in tests

Return a stable instance to make cleanRoles()/addRole() deterministic across calls.

Apply:

-    private $authorization;
+    private $authorization;
@@
-    public function getAuthorization(): Authorization
-    {
-        if (isset($this->authorization)) {
-            return $this->authorization;
-        }
-        return new Authorization();
-    }
+    public function getAuthorization(): Authorization
+    {
+        if (!isset($this->authorization)) {
+            $this->authorization = new Authorization();
+        }
+        return $this->authorization;
+    }

Also applies to: 125-127, 147-149, 159-161, 235-237

tests/unit/Messaging/MessagingChannelsTest.php (1)

38-46: Return a stable Authorization instance

Avoid creating a new Authorization per call; cache it on first use.

-    public function getAuthorization(): Authorization
-    {
-        if (isset($this->authorization)) {
-            return $this->authorization;
-        }
-        return new Authorization();
-    }
+    public function getAuthorization(): Authorization
+    {
+        if (!isset($this->authorization)) {
+            $this->authorization = new Authorization();
+        }
+        return $this->authorization;
+    }

src/Appwrite/Platform/Modules/Databases/Http/Databases/Collections/Documents/Get.php (1)

76-78: Minor: avoid duplicate getRoles() calls

Store roles once to compute both flags.

-        $isAPIKey = Auth::isAppUser($dbForProject->getAuthorization()->getRoles());
-        $isPrivilegedUser = Auth::isPrivilegedUser($dbForProject->getAuthorization()->getRoles());
+        $roles = $dbForProject->getAuthorization()->getRoles();
+        $isAPIKey = Auth::isAppUser($roles);
+        $isPrivilegedUser = Auth::isPrivilegedUser($roles);

src/Appwrite/Platform/Modules/Databases/Http/Databases/Collections/Documents/Delete.php (1)

100-104: DRY: cache the Authorization instance locally.

Reduce repeated getAuthorization() calls and ease future changes.

-        $database = $dbForProject->getAuthorization()->skip(fn () => $dbForProject->getDocument('databases', $databaseId));
-        $isAPIKey = Auth::isAppUser($dbForProject->getAuthorization()->getRoles());
-        $isPrivilegedUser = Auth::isPrivilegedUser($dbForProject->getAuthorization()->getRoles());
+        $auth = $dbForProject->getAuthorization();
+        $database = $auth->skip(fn () => $dbForProject->getDocument('databases', $databaseId));
+        $isAPIKey = Auth::isAppUser($auth->getRoles());
+        $isPrivilegedUser = Auth::isPrivilegedUser($auth->getRoles());

src/Appwrite/Platform/Modules/Databases/Http/Databases/Collections/Documents/XList.php (1)

78-82: Instance-based Authorization usage is consistent.

Role checks and Authorization::skip(...) replacements via $dbForProject->getAuthorization() look correct.

Cache $auth locally to avoid repeated getAuthorization() calls:

-        $isAPIKey = Auth::isAppUser($dbForProject->getAuthorization()->getRoles());
-        $isPrivilegedUser = Auth::isPrivilegedUser($dbForProject->getAuthorization()->getRoles());
-        $database = $dbForProject->getAuthorization()->skip(fn () => $dbForProject->getDocument('databases', $databaseId));
+        $auth = $dbForProject->getAuthorization();
+        $isAPIKey = Auth::isAppUser($auth->getRoles());
+        $isPrivilegedUser = Auth::isPrivilegedUser($auth->getRoles());
+        $database = $auth->skip(fn () => $dbForProject->getDocument('databases', $databaseId));

Also applies to: 86-87, 114-115

app/init/database/filters.php (1)

347-357: Also skip auth when fetching targets to keep semantics consistent.

You skip for subscribers, but not for the subsequent targets find. If callers rely on bypassing permissions for this derived lookup, wrap it too.

-        if (\count($targetIds) > 0) {
-            return $database->skipValidation(fn () => $database->find('targets', [
-                Query::equal('$sequence', $targetIds)
-            ]));
-        }
+        if (\count($targetIds) > 0) {
+            return $database->getAuthorization()->skip(
+                fn () => $database->skipValidation(
+                    fn () => $database->find('targets', [
+                        Query::equal('$sequence', $targetIds)
+                    ])
+                )
+            );
+        }

Please confirm whether the previous behavior also skipped auth for targets; adjust if necessary.

tests/unit/Auth/AuthTest.php (1)

32-34: tearDown relies on the cached instance.

After fixing getAuthorization(), this remains correct. Optionally reset the property to null if you want a fresh instance per test.

 public function tearDown(): void
 {
     $this->getAuthorization()->cleanRoles();
     $this->getAuthorization()->addRole(Role::any()->toString());
+    // Optionally:
+    // $this->authorization = null;
 }

app/controllers/api/account.php (1)

5024-5052: Guard optional provider lookup; avoid empty-ID fetch

Only fetch provider when providerId is present; prevents unnecessary DB read and null internalId mismatches.

Apply:

-        $provider = $dbForProject->getAuthorization()->skip(fn () => $dbForProject->getDocument('providers', $providerId));
+        $provider = null;
+        if (!empty($providerId)) {
+            $provider = $dbForProject->getAuthorization()->skip(fn () => $dbForProject->getDocument('providers', $providerId));
+        }
@@
-                'providerId' => !empty($providerId) ? $providerId : null,
-                'providerInternalId' => !empty($providerId) ? $provider->getSequence() : null,
+                'providerId' => !empty($providerId) ? $providerId : null,
+                'providerInternalId' => (!empty($providerId) && $provider && !$provider->isEmpty()) ? $provider->getSequence() : null,

src/Appwrite/Platform/Modules/Databases/Http/Databases/Collections/Documents/Update.php (2)

79-79: Align permissions allowlist between validator and aggregation

Validator allows WRITE, but aggregation only expands READ/UPDATE/DELETE. Make both consistent to avoid surprising behavior.

Option A: Allow WRITE in aggregation (and expand to the concrete permissions).
Option B (preferred here): Remove WRITE from the validator if not supported by this endpoint.

Example (Option B):

-            ->param('permissions', null, new Permissions(APP_LIMIT_ARRAY_PARAMS_SIZE, [Database::PERMISSION_READ, Database::PERMISSION_UPDATE, Database::PERMISSION_DELETE, Database::PERMISSION_WRITE]), 'An array of permissions strings. By default, the current permissions are inherited. [Learn more about permissions](https://appwrite.io/docs/permissions).', true)
+            ->param('permissions', null, new Permissions(APP_LIMIT_ARRAY_PARAMS_SIZE, [Database::PERMISSION_READ, Database::PERMISSION_UPDATE, Database::PERMISSION_DELETE]), 'An array of permissions strings. By default, the current permissions are inherited. [Learn more about permissions](https://appwrite.io/docs/permissions).', true)

Also applies to: 130-135

---

99-103: Minor: cache $auth to reduce repetition

Store $auth = $dbForProject->getAuthorization() once and reuse. Small readability win.

Also applies to: 136-154, 151-155, 248-255

src/Appwrite/Platform/Modules/Databases/Http/Databases/Collections/Documents/Upsert.php (2)

82-82: Align permissions allowlist with aggregation

Keep validator and aggregation in sync to avoid accepting WRITE but never expanding it.

Apply same approach as suggested in Update.php (either add WRITE to aggregation or drop it from validator).

Also applies to: 126-127

---

107-116: Minor: cache $auth to reduce repetition

Use a local $auth = $dbForProject->getAuthorization() to simplify repeated calls.

Also applies to: 151-170, 202-205, 219-223, 255-258

src/Appwrite/Platform/Modules/Databases/Http/Databases/Collections/Documents/Create.php (1)

180-182: Avoid repeated role lookups.

Micro-optimization/readability: fetch roles once.

-        $isAPIKey = Auth::isAppUser($dbForProject->getAuthorization()->getRoles());
-        $isPrivilegedUser = Auth::isPrivilegedUser($dbForProject->getAuthorization()->getRoles());
+        $roles = $dbForProject->getAuthorization()->getRoles();
+        $isAPIKey = Auth::isAppUser($roles);
+        $isPrivilegedUser = Auth::isPrivilegedUser($roles);

app/controllers/shared/api.php (1)

470-476: Reuse a single $roles variable per request block.

You already compute $roles at Line 472; pass it through and reuse to avoid multiple getRoles() calls.

Also applies to: 572-576, 589-592, 871-873

app/controllers/api/storage.php (1)

431-442: Minor: cache roles and reuse across checks.

Within each handler, fetch roles once and reuse for isAppUser/isPrivilegedUser and error messages.

-        $isAPIKey = Auth::isAppUser($dbForProject->getAuthorization()->getRoles());
-        $isPrivilegedUser = Auth::isPrivilegedUser($dbForProject->getAuthorization()->getRoles());
+        $roles = $dbForProject->getAuthorization()->getRoles();
+        $isAPIKey = Auth::isAppUser($roles);
+        $isPrivilegedUser = Auth::isPrivilegedUser($roles);
@@
-        $roles = $dbForProject->getAuthorization()->getRoles();
+        // reuse $roles from above

Also applies to: 463-479

app/controllers/api/teams.php (2)

604-606: Prefer Role helper over string literal for owner check.

Avoid string typos; use API:

-$isOwner = $dbForProject->getAuthorization()->hasRole('team:' . $team->getId() . '/owner');
+$isOwner = $dbForProject->getAuthorization()->hasRole(Role::team($team->getId(), 'owner')->toString());

---

1232-1266: Duplicate addRole for the same user; remove one.

Role is added at Line 1236 and again at Line 1264. Keep one to avoid redundant mutations/log noise.

-            $dbForProject->getAuthorization()->addRole(Role::user($user->getId())->toString());
+            $dbForProject->getAuthorization()->addRole(Role::user($user->getId())->toString());
...
-            $dbForProject->getAuthorization()->addRole(Role::user($userId)->toString());
+            // already added above

app/init/resources.php (3)

457-491: Duplicate setAuthorization in getProjectDB (new-instance path).

$configure() already sets authorization; the earlier call is redundant.

-        $adapter = new DatabasePool($pools->get($dsn->getHost()));
-        $database = new Database($adapter, $cache);
-        $database->setAuthorization($authorization);
+        $adapter = new DatabasePool($pools->get($dsn->getHost()));
+        $database = new Database($adapter, $cache);
         $databases[$dsn->getHost()] = $database;
         $configure($database);

---

229-240: Use the injected Authorization directly for clarity.

Since the same Authorization instance is set on both DBs, calling setDefaultStatus on it directly is clearer.

-    $dbForPlatform->getAuthorization()->setDefaultStatus(true);
+    $authorization = $dbForPlatform->getAuthorization();
+    $authorization->setDefaultStatus(true);

---

496-523: Authorization not set on adapter in init/resources.php.

Verified: workers set Authorization on DatabasePool adapter (app/worker.php:152), while all four DatabasePool instances in app/init/resources.php (lines 399, 428, 486, 505) set it only on the Database object. The patterns differ consistently. If adapter-level authorization is required for feature parity, align the init/resources.php instances accordingly.

app/worker.php (1)

58-68: Optional: add standard timeouts/metadata to dbForPlatform (parity with API).

Not required, but aligning with API defaults (timeouts, metadata) could aid observability and consistency.

app/cli.php (1)

150-154: Set authorization on the adapter in DatabasePool instantiations for consistency with worker.php.

Verification confirms that DatabasePool::setAuthorization exists and is called in app/worker.php (line 152), but not in app/cli.php or app/init/resources.php. All three locations instantiate DatabasePool but only worker.php calls $adapter->setAuthorization($authorization) before wrapping it in a Database object.

The adapter propagates its authorization to underlying pooled adapters when delegating calls, so aligning cli.php (lines 76, 150, 185) and init/resources.php (lines 399, 428, 486, 505) with the worker pattern would ensure consistent behavior across entry points.

composer.json (1)

51-51: Remove or stabilize development branch dependencies before releasing.

Both utopia-php/audit and utopia-php/database are pinned to development branches (dev-feat-auth-single-instance and dev-feat-authorization-instance). This is problematic for a production release:

• utopia-php/database (line 55): As noted in the previous review, feat-authorization-instance remains unmerged and diverged from main (31 commits ahead, 5 behind). Stable version 3.0.2 is already available.
• utopia-php/audit (line 51): Same concern applies—dev branches introduce instability and obscure dependency management.

Before merging to a release branch (1.8.x), replace these with stable versions:

-        "utopia-php/audit": "dev-feat-auth-single-instance as 1.1.0",
+        "utopia-php/audit": "^1.1.0",

-        "utopia-php/database": "dev-feat-authorization-instance as 3.0.2",
+        "utopia-php/database": "^3.0.2",

Alternatively, merge both feature branches into their respective main branches and publish stable releases before referencing them here.

Also applies to: 55-55

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

src/Appwrite/Platform/Modules/Databases/Http/Databases/Transactions/Operations/Create.php (1)

169-181: Fix Input casing and normalize permission source.

• Use new Input(...) (capital “I”); current new input(...) will fatally error.
• Prefer a consistent source for roles. Passing full $resource->getPermissions() with the requested type to Input avoids API mismatches.

Apply:

-                    $collectionValid = $dbForProject->getAuthorization()->isValid(
-                        new input($permissionType, $collection->getPermissionsByType($permissionType))
-                    );
+                    $collectionValid = $dbForProject->getAuthorization()->isValid(
+                        new Input($permissionType, $collection->getPermissions())
+                    );
@@
-                        if ($permissionType === Database::PERMISSION_UPDATE) {
-                            $documentValid = $dbForProject->getAuthorization()->isValid(
-                                new input(Database::PERMISSION_UPDATE, $document->getUpdate())
-                            );
-                        } elseif ($permissionType === Database::PERMISSION_DELETE) {
-                            $documentValid = $dbForProject->getAuthorization()->isValid(
-                                new input(Database::PERMISSION_DELETE, $document->getDelete())
-                            );
-                        }
+                        if ($permissionType === Database::PERMISSION_UPDATE) {
+                            $documentValid = $dbForProject->getAuthorization()->isValid(
+                                new Input(Database::PERMISSION_UPDATE, $document->getPermissions())
+                            );
+                        } elseif ($permissionType === Database::PERMISSION_DELETE) {
+                            $documentValid = $dbForProject->getAuthorization()->isValid(
+                                new Input(Database::PERMISSION_DELETE, $document->getPermissions())
+                            );
+                        }

If you intentionally rely on per-type getters (e.g., getUpdate()), keep them but still fix the casing:

- new input(Database::PERMISSION_UPDATE, $document->getUpdate())
+ new Input(Database::PERMISSION_UPDATE, $document->getUpdate())

Run to catch any remaining issues:

#!/bin/bash
# 1) Lowercase Input constructors
rg -nP --type=php 'new\s+input\s*\('

# 2) Mixed permission APIs - audit availability
rg -nP --type=php '\->getPermissionsByType\(|\->get(Update|Delete)\(\)|\->getPermissions\(\)' src -C2

app/init/resources.php (1)

229-341: Consider injecting the Authorization into Request/Response early.

If not already done upstream, call $request->setAuthorization($authorization) and $response->setAuthorization($authorization) during bootstrap to keep the per-request context consistent. As per provided setters.

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

composer.json (1)

55-55: Remove development branch dependency for database package (persistent critical issue).

This issue was flagged in the prior review but remains unresolved. Using dev-feat-authorization-instance for production code introduces instability. A stable release (3.0.2) is available and should be used instead.

Change line 55 to use the stable release:

-        "utopia-php/database": "dev-feat-authorization-instance as 3.0.2",
+        "utopia-php/database": "^3.0.2",

If the stable 3.0.2 release does not include required authorization features, the feature branch must be merged into main, a new stable version released, and then pinned to that release before this PR can be merged.

Verify branch status:

#!/bin/bash
# Confirm stable 3.0.2 is available
gh api repos/utopia-php/database/releases --jq '.[] | select(.tag_name == "3.0.2")'

# Check feature branch status
gh api repos/utopia-php/database/branches/feat-authorization-instance --jq '{name, commit: .commit.sha}'

# Check divergence
gh api repos/utopia-php/database/compare/main...feat-authorization-instance --jq '{ahead_by, behind_by, status}'

app/controllers/api/storage.php (1)

34-34: LGTM! Authorization refactor is well-executed.

The transition from static Authorization methods to instance-based authorization accessed via $dbForProject->getAuthorization() is consistent and correct. The Input validator import and usage are appropriate, and error messages now include descriptive details via getDescription().

Optional: Cache the authorization object for improved readability.

Throughout the file, getAuthorization() is called multiple times in quick succession within the same endpoint. While this is not a bug (the method returns the same instance), caching it in a local variable would reduce repetition and improve readability:

+$authorization = $dbForProject->getAuthorization();
-$bucket = $dbForProject->getAuthorization()->skip(fn () => $dbForProject->getDocument('buckets', $bucketId));
+$bucket = $authorization->skip(fn () => $dbForProject->getDocument('buckets', $bucketId));

-$isAPIKey = Auth::isAppUser($dbForProject->getAuthorization()->getRoles());
-$isPrivilegedUser = Auth::isPrivilegedUser($dbForProject->getAuthorization()->getRoles());
+$isAPIKey = Auth::isAppUser($authorization->getRoles());
+$isPrivilegedUser = Auth::isPrivilegedUser($authorization->getRoles());

-if (!$dbForProject->getAuthorization()->isValid(new Input(Database::PERMISSION_CREATE, $bucket->getCreate()))) {
-    throw new Exception(Exception::USER_UNAUTHORIZED, $dbForProject->getAuthorization()->getDescription());
+if (!$authorization->isValid(new Input(Database::PERMISSION_CREATE, $bucket->getCreate()))) {
+    throw new Exception(Exception::USER_UNAUTHORIZED, $authorization->getDescription());
 }

This pattern applies to many endpoints in the file (e.g., lines 789-801, 889-902, 970-995, 1161-1185, 1321-1345, 1474-1499, 1647-1660, 1760-1786).

Also applies to: 431-441

src/Appwrite/Platform/Modules/Databases/Http/Databases/Transactions/Operations/Create.php (1)

174-181: Tidy doc-permission check (optional).

Reduce duplication and make intent explicit with a small match-based selection.

-                    if ($document !== null && !$document->isEmpty() && $documentSecurity) {
-                        if ($permissionType === Database::PERMISSION_UPDATE) {
-                            $documentValid = $dbForProject->getAuthorization()->isValid(
-                                new Input(Database::PERMISSION_UPDATE, $document->getUpdate())
-                            );
-                        } elseif ($permissionType === Database::PERMISSION_DELETE) {
-                            $documentValid = $dbForProject->getAuthorization()->isValid(
-                                new Input(Database::PERMISSION_DELETE, $document->getDelete())
-                            );
-                        }
-                    }
+                    if ($document !== null && !$document->isEmpty() && $documentSecurity) {
+                        $docPerms = match ($permissionType) {
+                            Database::PERMISSION_UPDATE => $document->getUpdate(),
+                            Database::PERMISSION_DELETE => $document->getDelete(),
+                            default => null,
+                        };
+                        if ($docPerms !== null) {
+                            $documentValid = $dbForProject->getAuthorization()->isValid(
+                                new Input($permissionType, $docPerms)
+                            );
+                        }
+                    }

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

tests/e2e/Services/Databases/TablesDB/Permissions/DatabasesPermissionsGuestTest.php (1)

20-30: LGTM! Proper per-instance Authorization implementation.

The lazy initialization pattern correctly caches the Authorization instance, which is appropriate for per-instance usage in tests. This implementation is consistent with similar patterns in AuthTest.php and MessagingChannelsTest.php.

Minor: The extra blank line at Line 27 can be removed for consistency:

         
         $this->authorization = new Authorization();
-        return $this->authorization; 
+        return $this->authorization;
     }
-

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

.github/workflows/issue-triage.lock.yml (1)

1204-1205: Pin the mcp/fetch container image.

Unpinned images are a supply‑chain risk and harm reproducibility. Use a version tag and preferably a digest.

-          docker pull mcp/fetch
+          docker pull mcp/fetch:<version>@sha256:<digest>
...
-                "args": [
+                "args": [
                   "run",
                   "-i",
                   "--rm",
-                  "mcp/fetch"
+                  "mcp/fetch:<version>@sha256:<digest>"
                 ],

Also applies to: 2044-2051

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Learnt from: abnegate
Repo: appwrite/appwrite PR: 10297
File: app/controllers/api/users.php:649-657
Timestamp: 2025-08-11T10:32:38.142Z
Learning: In Appwrite's utopia-php/database (version 0.77.* and later), the database layer internally handles filter separation for count operations. When using `$dbForProject->count()` within a `skipFilters` closure, there's no need to manually separate filter queries using `Query::groupByType($queries)['filters']` as the database handles this automatically.

src/Appwrite/Platform/Modules/Databases/Http/Databases/Collections/Documents/Create.php (1)

264-284: Fix UPDATE permission logic with documentSecurity=false (re-break).

When permission=UPDATE and documentSecurity=false, the current condition always throws even if collection UPDATE is allowed. Align with the transactions operations pattern: require collection perms when documentSecurity=false; otherwise allow if either collection OR document perms are valid.

Apply:

-            $validCollection = $authorization->isValid(
-                new Input($permission, $collection->getPermissionsByType($permission))
-            );
-            if (($permission === Database::PERMISSION_UPDATE && !$documentSecurity) || !$validCollection) {
-                throw new Exception(Exception::USER_UNAUTHORIZED, $authorization->getDescription());
-            }
-
-            if ($permission === Database::PERMISSION_UPDATE) {
-                $validDocument = $authorization->isValid(
-                    new Input($permission, $document->getUpdate())
-                );
-                $valid = $validCollection || $validDocument;
-                if ($documentSecurity && !$valid) {
-                    throw new Exception(Exception::USER_UNAUTHORIZED, $authorization->getDescription());
-                }
-            }
+            $validCollection = $authorization->isValid(
+                new Input($permission, $collection->getPermissionsByType($permission))
+            );
+
+            if ($permission === Database::PERMISSION_UPDATE) {
+                $validDocument = $authorization->isValid(
+                    new Input(Database::PERMISSION_UPDATE, $document->getUpdate())
+                );
+                if (!$documentSecurity) {
+                    if (!$validCollection) {
+                        throw new Exception(Exception::USER_UNAUTHORIZED, $authorization->getDescription());
+                    }
+                } else {
+                    if (!$validCollection && !$validDocument) {
+                        throw new Exception(Exception::USER_UNAUTHORIZED, $authorization->getDescription());
+                    }
+                }
+            } else { // CREATE
+                if (!$validCollection) {
+                    throw new Exception(Exception::USER_UNAUTHORIZED, $authorization->getDescription());
+                }
+            }

app/controllers/general.php (1)

1329-1329: Don’t log raw roles; log coarse flags/count instead

Roles may contain user/team IDs (PII). Log non-identifying flags.

-            $log->addExtra('roles', $authorization->getRoles());
+            $roles = $authorization->getRoles();
+            $log->addExtra('roleFlags', [
+                'isPrivileged' => Auth::isPrivilegedUser($roles),
+                'isAppUser' => Auth::isAppUser($roles),
+                'count' => count($roles),
+            ]);

app/controllers/api/migrations.php (1)

345-349: Include API keys in internal file access guard

Allow API keys as well as privileged users; otherwise valid API key calls will be rejected.

-        if ($internalFile && !$isPrivilegedUser) {
+        if ($internalFile && !$isAPIKey && !$isPrivilegedUser) {
             throw new Exception(Exception::USER_UNAUTHORIZED);
         }

app/controllers/shared/api.php (1)

585-616: Minor: avoid re-computing $isPrivilegedUser.

$roles and $isPrivilegedUser are computed earlier; reuse them to reduce duplication.

Consider removing the second assignment:

-                    $isPrivilegedUser = Auth::isPrivilegedUser($authorization->getRoles());
+                    // reuse previously computed $isPrivilegedUser

app/controllers/api/users.php (1)

2661-2684: Tiny cleanup: drop unused loop index

$count isn’t used. Iterate directly over $metrics.

-        $authorization->skip(function () use ($dbForProject, $days, $metrics, &$stats) {
-            foreach ($metrics as $count => $metric) {
+        $authorization->skip(function () use ($dbForProject, $days, $metrics, &$stats) {
+            foreach ($metrics as $metric) {

app/controllers/general.php (1)

60-60: Unused parameter: $utopia

router() doesn’t use $utopia. Consider prefixing with _ or removing to silence PHPMD.

-function router(App $utopia, Database $dbForPlatform, callable $getProjectDB, SwooleRequest $swooleRequest, Request $request, Response $response, Log $log, Event $queueForEvents, StatsUsage $queueForStatsUsage, Func $queueForFunctions, Executor $executor, Reader $geodb, callable $isResourceBlocked, string $previewHostname, Authorization $authorization, ?Key $apiKey)
+function router(App $_, Database $dbForPlatform, callable $getProjectDB, SwooleRequest $swooleRequest, Request $request, Response $response, Log $log, Event $queueForEvents, StatsUsage $queueForStatsUsage, Func $queueForFunctions, Executor $executor, Reader $geodb, callable $isResourceBlocked, string $previewHostname, Authorization $authorization, ?Key $apiKey)

src/Appwrite/Platform/Modules/Databases/Http/Databases/Transactions/Update.php (1)

106-107: Remove unused $user parameter from action() method signature

The $user parameter (Document $user) is unused in the action() method. Verification confirms:

• Ripgrep search found $user only in the function signature and PHPDoc comment—no usage anywhere in the file
• The main transaction processing closure at line 141 explicitly lists captured variables in its use() clause and notably omits $user
• No indirect references through closures or callbacks

Removing this parameter will reduce the dependency injection surface as suggested. Update line 106 to remove Document $user, from the parameter list.

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Learnt from: ItzNotABug
Repo: appwrite/appwrite PR: 9693
File: src/Appwrite/Platform/Modules/Databases/Http/Databases/Collections/Indexes/Delete.php:85-86
Timestamp: 2025-05-10T04:12:13.037Z
Learning: The class `Appwrite\Platform\Modules\Databases\Http\Databases\Collections\Indexes\Action` defines a method `getGrantParentNotFoundException()` which is used to handle cases where a parent resource (like a database collection) is not found.

Learnt from: abnegate
Repo: appwrite/appwrite PR: 10023
File: src/Appwrite/Databases/TransactionState.php:174-219
Timestamp: 2025-10-02T10:16:48.075Z
Learning: In `src/Appwrite/Databases/TransactionState.php`, the `listDocuments` method intentionally applies queries only to the initial database fetch of committed documents. Transaction state changes (creates, updates, deletes) are then overlaid on top of the filtered committed set without re-evaluating the queries against the final merged result. This is the intended behavior for transaction-aware document listing.

Learnt from: ItzNotABug
Repo: appwrite/appwrite PR: 9693
File: src/Appwrite/Platform/Modules/Databases/Http/Databases/Tables/Update.php:57-59
Timestamp: 2025-06-19T09:20:03.312Z
Learning: In table-related endpoints (such as `src/Appwrite/Platform/Modules/Databases/Http/Databases/Tables/Update.php`), parameter descriptions should use "table" and "row" terminology instead of "collection" and "document" for clarity and consistency.

Learnt from: abnegate
Repo: appwrite/appwrite PR: 10546
File: src/Appwrite/Platform/Workers/Migrations.php:144-148
Timestamp: 2025-10-23T08:06:38.889Z
Learning: In the Appwrite codebase, migration workers receive already-validated data from queued jobs. Query validation using Query::parseQueries() happens at the API endpoint level (with try-catch for QueryException) before jobs are queued, so workers in src/Appwrite/Platform/Workers/Migrations.php don't need redundant validation.

Learnt from: ItzNotABug
Repo: appwrite/appwrite PR: 9752
File: app/config/collections/platform.php:1423-1423
Timestamp: 2025-05-13T12:02:08.071Z
Learning: In the Appwrite database schema, field names like 'resourceInternalId'/'resourceType' and 'deploymentInternalId'/'deploymentResourceType' are functionally equivalent and can coexist in the codebase without causing errors. The docker build and stack work fine with these naming inconsistencies.

Learnt from: abnegate
Repo: appwrite/appwrite PR: 10297
File: app/controllers/api/users.php:649-657
Timestamp: 2025-08-11T10:32:38.142Z
Learning: In Appwrite's utopia-php/database (version 0.77.* and later), the database layer internally handles filter separation for count operations. When using `$dbForProject->count()` within a `skipFilters` closure, there's no need to manually separate filter queries using `Query::groupByType($queries)['filters']` as the database handles this automatically.