Fix authorization errors reversing current and allowed roles

src/Database/Validator/Authorization.php

@@ -68,15 +68,13 @@ public function isValid(mixed $input): bool
             return false;
         }
 
-        $permission = '-';
-
         foreach ($permissions as $permission) {
             if (\array_key_exists($permission, $this->roles)) {
                 return true;
             }
         }
 
-        $this->message = 'Missing "'.$action.'" permission for role "'.$permission.'". Only "'.\json_encode($this->getRoles()).'" scopes are allowed and "'.\json_encode($permissions).'" was given.';
+        $this->message = 'Missing "'.$action.'" permission for roles '.\json_encode($this->getRoles()).'. Only '.\json_encode($permissions).' roles are allowed.';
         return false;
     }
 

tests/e2e/Adapter/Scopes/DocumentTests.php

@@ -5782,7 +5782,7 @@ public function testUpdateDocuments(): void
             ]));
             $this->fail('Failed to throw exception');
         } catch (AuthorizationException $e) {
-            $this->assertStringStartsWith('Missing "update" permission for role "user:asd".', $e->getMessage());
+            $this->assertSame('Missing "update" permission for roles ["any"]. Only ["user:asd"] roles are allowed.', $e->getMessage());
         }
 
         // Check document level permissions

tests/e2e/Adapter/Scopes/RelationshipTests.php

@@ -1764,7 +1764,7 @@ public function testEnforceRelationshipPermissions(): void
             );
             $this->fail('Failed to throw exception');
         } catch (Exception $e) {
-            $this->assertEquals('Missing "update" permission for role "user:user1". Only "["any"]" scopes are allowed and "["user:user1"]" was given.', $e->getMessage());
+            $this->assertEquals('Missing "update" permission for roles ["any"]. Only ["user:user1"] roles are allowed.', $e->getMessage());
         }
 
         // Try delete root document
@@ -1775,7 +1775,7 @@ public function testEnforceRelationshipPermissions(): void
             );
             $this->fail('Failed to throw exception');
         } catch (Exception $e) {
-            $this->assertEquals('Missing "delete" permission for role "user:user2". Only "["any"]" scopes are allowed and "["user:user2"]" was given.', $e->getMessage());
+            $this->assertEquals('Missing "delete" permission for roles ["any"]. Only ["user:user2"] roles are allowed.', $e->getMessage());
         }
 
         $tree1 = $database->getDocument('trees', 'tree1');
@@ -1789,7 +1789,7 @@ public function testEnforceRelationshipPermissions(): void
             );
             $this->fail('Failed to throw exception');
         } catch (Exception $e) {
-            $this->assertEquals('Missing "update" permission for role "user:user1". Only "["any"]" scopes are allowed and "["user:user1"]" was given.', $e->getMessage());
+            $this->assertEquals('Missing "update" permission for roles ["any"]. Only ["user:user1"] roles are allowed.', $e->getMessage());
         }
 
         // Try delete nested document
@@ -1800,7 +1800,7 @@ public function testEnforceRelationshipPermissions(): void
             );
             $this->fail('Failed to throw exception');
         } catch (Exception $e) {
-            $this->assertEquals('Missing "delete" permission for role "user:user2". Only "["any"]" scopes are allowed and "["user:user2"]" was given.', $e->getMessage());
+            $this->assertEquals('Missing "delete" permission for roles ["any"]. Only ["user:user2"] roles are allowed.', $e->getMessage());
         }
 
         $bird1 = $database->getDocument('birds', 'bird1');
@@ -1814,7 +1814,7 @@ public function testEnforceRelationshipPermissions(): void
             );
             $this->fail('Failed to throw exception when updating document with missing permissions');
         } catch (Exception $e) {
-            $this->assertEquals('Missing "update" permission for role "user:user1". Only "["any"]" scopes are allowed and "["user:user1"]" was given.', $e->getMessage());
+            $this->assertEquals('Missing "update" permission for roles ["any"]. Only ["user:user1"] roles are allowed.', $e->getMessage());
         }
 
         // Try delete multi-level nested document
@@ -1825,7 +1825,7 @@ public function testEnforceRelationshipPermissions(): void
             );
             $this->fail('Failed to throw exception');
         } catch (Exception $e) {
-            $this->assertEquals('Missing "delete" permission for role "user:user2". Only "["any"]" scopes are allowed and "["user:user2"]" was given.', $e->getMessage());
+            $this->assertEquals('Missing "delete" permission for roles ["any"]. Only ["user:user2"] roles are allowed.', $e->getMessage());
         }
 
         $this->getDatabase()->getAuthorization()->addRole(Role::user('user1')->toString());

tests/unit/Validator/AuthorizationTest.php

@@ -123,4 +123,26 @@ public function testNestedSkips(): void
 
         $this->assertEquals(true, $this->authorization->getStatus());
     }
+
+    public function testDeniedRolesDescription(): void
+    {
+        $this->authorization->addRole(Role::guests()->toString());
+
+        $this->assertFalse($this->authorization->isValid(new Input('execute', [
+            Role::user('joe')->toString(),
+            Role::team('admins')->toString(),
+        ])));
+        $this->assertSame(
+            'Missing "execute" permission for roles ["any","guests"]. Only ["user:joe","team:admins"] roles are allowed.',
+            $this->authorization->getDescription()
+        );
+
+        $this->authorization->cleanRoles();
+
+        $this->assertFalse($this->authorization->isValid(new Input(Database::PERMISSION_READ, [Role::users()->toString()])));
+        $this->assertSame(
+            'Missing "read" permission for roles []. Only ["users"] roles are allowed.',
+            $this->authorization->getDescription()
+        );
+    }
 }