Security context

Highlights

Auth Bypass: 3 prior fixes. Scrutinize any change in this area.

src/AbstractRole.php: most-fixed (2 issues). Treat as high-risk during review.

3 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

Auth Bypass: Flaws in role inheritance logic allowed low-privilege child roles to inherit highly-privileged parent permissions due to incorrect traversal direction, and caused secondary parent permissions to be ignored entirely when multiple parent roles were defined.

Auth Bypass: A dynamic assertion logic flaw allowed authorization bypasses because the assertion check bypassed standard static permission checks entirely when returning true, instead of acting as an additional guard.