fix comments

Author: fogelito

src/Database/Database.php

@@ -8279,8 +8279,10 @@ public function upsertDocumentsWithIncrease(
             $old = $existingDocs[$this->tenantKey($document)] ?? new Document();
 
             // Captured here, before encoding materialises every column of the
-            // collection. Keyed by id because the batches are re-indexed later.
-            $suppliedColumns[$document->getId()] = self::suppliedColumns($document);
+            // collection. Keyed by tenant identity, not id: the batches are re-indexed
+            // later, and in tenant-per-document mode one batch can carry the same id for
+            // two tenants, whose exemptions must not overwrite each other.
+            $suppliedColumns[$this->tenantKey($document)] = self::suppliedColumns($document);
 
             $document = $this->removeUnknownAttributes($collection, $document);
 
@@ -8546,7 +8548,7 @@ public function upsertDocumentsWithIncrease(
                     // not $doc. $doc is the adapter's merged result, so using it would
                     // exempt every stored column and mask nothing at all.
                     $onNext && $onNext(
-                        $this->maskWriteResponse($collection, $doc, $suppliedColumns[$doc->getId()] ?? []),
+                        $this->maskWriteResponse($collection, $doc, $suppliedColumns[$this->tenantKey($doc)] ?? []),
                         $old->isEmpty() ? null : $this->maskUnreadableColumns($collection, $old)
                     );
                 } catch (\Throwable $th) {

tests/unit/ColumnPermissionSqlTest.php

@@ -110,13 +110,37 @@ private function shape(array $rows): array
         return $shape;
     }
 
-    public function testColumnIsPersistedOnThePermissionsTable(): void
+    /**
+     * A column-scoped grant lives in two places: the _permissions JSON on the row, which
+     * drives masking, and a _perms row, which drives the find/count/sum gate. Re-scoping
+     * the grant to another column has to move both. If only the JSON is rewritten the
+     * filter still answers on the old column -- which is what happens when the permission
+     * diff compares roles and ignores the column.
+     */
+    public function testRescopingAGrantMovesBothTheMaskAndTheFilter(): void
     {
-        $rows = $this->authorization->skip(
-            fn () => $this->database->find('employees', [Query::equal('$id', ['e1'])])
+        $this->as(['any', 'user:hr']);
+
+        $this->assertSame(
+            ['e1' => ['name', 'salary']],
+            $this->shape($this->database->find('employees', [Query::greaterThan('salary', 95000)]))
+        );
+
+        $this->authorization->skip(fn () => $this->database->updateDocument('employees', 'e1', new Document([
+            '$permissions' => [Permission::read(Role::user('hr'), 'name')],
+        ])));
+
+        $this->as(['any', 'user:hr']);
+
+        // the mask no longer yields salary...
+        $this->assertSame(
+            ['e1' => ['name'], 'e2' => ['name']],
+            $this->shape($this->database->find('employees'))
         );
 
-        $this->assertSame(['read("user:hr", "salary")'], $rows[0]->getPermissions());
+        // ...and neither does the gate, so the row cannot be found through it
+        $this->assertSame([], $this->database->find('employees', [Query::greaterThan('salary', 95000)]));
+        $this->assertSame(0, $this->database->sum('employees', 'salary'));
     }
 
     /**