Improve Permission authorization and cache performance

.github/workflows/redis.yml

@@ -68,6 +68,7 @@ jobs:
           vendor/bin/paratest --max-processes=15 tests/Integration/Horizon
           vendor/bin/paratest --max-processes=15 tests/Integration/Http/Redis
           vendor/bin/paratest --max-processes=15 tests/Integration/OpenTelemetry/Redis
+          CACHE_STORE=redis vendor/bin/paratest --max-processes=15 tests/Permission
           QUEUE_CONNECTION=redis vendor/bin/paratest --max-processes=15 tests/Integration/Queue
           vendor/bin/paratest --max-processes=15 tests/Integration/RateLimiter/Redis
           vendor/bin/paratest --max-processes=15 tests/Integration/Redis

.github/workflows/tests.yml

@@ -54,6 +54,9 @@ jobs:
       - name: Run framework test suite
         run: vendor/bin/paratest -c phpunit.xml.dist
 
+      - name: Run Permission suite with the database cache store
+        run: CACHE_STORE=database vendor/bin/paratest -c phpunit.xml.dist tests/Permission
+
       - name: Run Testbench package-mode suite
         run: php src/testbench/bin/testbench package:test --parallel tests/Testbench
 

docs/upstream-sync/sync.yaml

@@ -160,9 +160,10 @@ spatie/laravel-data:
 
 spatie/laravel-permission:
   branch: main
-  checked_through: null
+  checked_through: 6615eefac655efcd652fe394a20cbdf4f72c609f
   last_reviewed_pr: null
-  sync_date: null
+  sync_date: '2026-10-05'
+  notes: Upstream Pest files map to PHPUnit classes at the same paths under tests/Permission, with each it()/test() description as the method name. Upstream's permission.testing migration flag, which adds the roles team column while teams are off so cases can enable teams mid-test, is not ported; those cases enable teams before migrating through the DefineEnvironment attribute's usesTeams method. The CACHE_DRIVER cache-driver test runs map to CACHE_STORE. Passport::actingAsClient() maps to TestCase::actingAsClient() with the PassportGuard fixture because Hypervel has no Passport package. Upstream's single cached permission collection maps to PermissionRegistrar's catalog payload (getSerializedPermissionsForCache() stores role keys per permission; permissionCatalog() and modelClassCatalog() hydrate it) plus the per-model assignment caches (rememberModel*()), which are filled through Cache\ModelCacheCoordinator and invalidated after commit; apply upstream cache or loading changes to both. Upstream relation definitions map to the Role and Permission relation methods built through BuildsPermissionRelations, whose Partitioned* relations add partition and team constraints and loaded-relation tracking. Upstream's detach-then-attach syncs map to HasRoles::syncRoles() and HasPermissions::synchronizePermissionAssignments(), which read the current pivots and write only the differences, keeping each permission's is_denied effect. Upstream docs map to sections of src/docs/permission.md; the example app, PhpStorm, UI options, schema diagram, upgrade and project pages are not ported.
 
 aimeos/laravel-nestedset:
   branch: master

src/cache/src/ModelCacheCoordinator.php

@@ -6,9 +6,11 @@
 
 use Closure;
 use Hypervel\Cache\Exceptions\UnsupportedModelCacheStoreException;
+use Hypervel\Contracts\Cache\AuthoritativeRawReadable;
 use Hypervel\Contracts\Cache\LockProvider;
 use Hypervel\Contracts\Cache\RefreshableLock;
 use Hypervel\Contracts\Cache\Repository as CacheRepository;
+use Hypervel\Contracts\Cache\Store;
 
 /**
  * Coordinate shared model cache fills and exact invalidations.
@@ -65,14 +67,22 @@ public function fill(
             return $cached[self::ENVELOPE_VALUE_KEY];
         }
 
-        $lock = $this->lock($cache, $key);
+        $store = $cache->getStore();
+        $lock = $this->lock($store, $key);
         $acquired = false;
         $result = $lock
-            ->get(function () use ($cache, $key, $ttl, $read, $cacheNull, $writeCache, $lock, &$acquired): mixed {
+            ->get(function () use ($cache, $store, $key, $ttl, $read, $cacheNull, $writeCache, $lock, &$acquired): mixed {
                 $acquired = true;
-                $cached = $cache->get($key);
+
+                // A memoized read would repeat the miss above and hide a fill that
+                // finished before this lock was acquired.
+                $cached = $cache instanceof AuthoritativeRawReadable
+                    ? $cache->getAuthoritativeRaw($key)
+                    : $cache->get($key);
 
                 if ($this->isEnvelope($cached)) {
+                    $this->rememberEnvelope($store, $key, $cached);
+
                     return $cached[self::ENVELOPE_VALUE_KEY];
                 }
 
@@ -88,8 +98,13 @@ public function fill(
                     return $value;
                 }
 
-                ($writeCache === null ? $cache : $writeCache())
-                    ->put($key, $this->envelope($value), $ttl);
+                $envelope = $this->envelope($value);
+                $published = ($writeCache === null ? $cache : $writeCache())
+                    ->put($key, $envelope, $ttl);
+
+                if ($published && $writeCache === null) {
+                    $this->rememberEnvelope($store, $key, $envelope);
+                }
 
                 return $value;
             });
@@ -102,7 +117,7 @@ public function fill(
      */
     public function invalidate(CacheRepository $cache, string $key): bool
     {
-        return (bool) $this->lock($cache, $key)
+        return (bool) $this->lock($cache->getStore(), $key)
             ->betweenBlockedAttemptsSleepFor(self::INVALIDATION_RETRY_MILLISECONDS)
             ->block(
                 self::INVALIDATION_WAIT_SECONDS,
@@ -123,6 +138,25 @@ private function envelope(mixed $value): array
         ];
     }
 
+    /**
+     * Remember a shared envelope in a plain memoized store for the current coroutine.
+     *
+     * Memoized writes forget their key, and a memoized miss survives a store read
+     * that bypasses it, so later fills would otherwise lock and read the store again.
+     *
+     * @param array{__hypervel_model_cache: 'present', value: mixed} $envelope
+     */
+    private function rememberEnvelope(Store $store, string $key, array $envelope): void
+    {
+        // Memoized tagged caches expose their backing store, so tagged keys never reach this memo.
+        if (! $store instanceof MemoizedStore) {
+            return;
+        }
+
+        $store->forgetMemoized($key);
+        $store->memoize($key, fn (): array => $envelope);
+    }
+
     /**
      * Determine whether the value is a cache presence envelope.
      */
@@ -139,9 +173,8 @@ private function isEnvelope(mixed $value): bool
      *
      * @throws UnsupportedModelCacheStoreException
      */
-    private function lock(CacheRepository $cache, string $key): RefreshableLock
+    private function lock(Store $store, string $key): RefreshableLock
     {
-        $store = $cache->getStore();
         $validatedStore = $store instanceof MemoizedStore
             ? $store->getInnerStore()
             : $store;