fix(memory): address remaining review findings

- exists($database, $collection) now keys lookup by the $database
  argument and the filtered collection name, so callers can probe a
  database other than the adapter's currently-bound one. Storage map
  is now [database][collectionName] => storageKey.
- updateDocument / updateDocuments / deleteDocument / deleteDocuments
  guard permission cleanup with the current tenant under shared
  tables, so deleting a row in tenant A no longer wipes another
  tenant's permissions for a document that happens to share the same
  $id.
- updateDocuments validates every row (including unique-index checks)
  before any write lands, so a uniqueness violation on row N no
  longer leaves rows 0..N-1 partially committed.
- TYPE_CONTAINS_ALL on object attributes now requires every candidate
  to be present, instead of returning true on the first match (was
  behaving like CONTAINS_ANY).

Author: abnegate

src/Database/Adapter/Memory.php

@@ -25,7 +25,7 @@ class Memory extends Adapter
     /**
      * Map of database name to the set of collection storage keys it owns.
      *
-     * @var array<string, array<string, true>>
+     * @var array<string, array<string, string>>
      */
     protected array $databases = [];
 
@@ -179,7 +179,7 @@ public function exists(string $database, ?string $collection = null): bool
             return false;
         }
 
-        return isset($this->databases[$database][$this->key($collection)]);
+        return isset($this->databases[$database][$this->filter($collection)]);
     }
 
     public function list(): array
@@ -198,7 +198,7 @@ public function delete(string $name): bool
             return true;
         }
 
-        foreach (\array_keys($this->databases[$name]) as $collectionKey) {
+        foreach ($this->databases[$name] as $collectionKey) {
             unset($this->data[$collectionKey]);
             unset($this->permissions[$collectionKey]);
         }
@@ -227,7 +227,7 @@ public function createCollection(string $name, array $attributes = [], array $in
             if (! isset($this->databases[$database])) {
                 $this->databases[$database] = [];
             }
-            $this->databases[$database][$key] = true;
+            $this->databases[$database][$this->filter($name)] = $key;
         }
 
         foreach ($attributes as $attribute) {
@@ -259,9 +259,10 @@ public function deleteCollection(string $id): bool
         $key = $this->key($id);
         unset($this->data[$key]);
         unset($this->permissions[$key]);
+        $filtered = $this->filter($id);
         foreach ($this->databases as $name => $collections) {
-            if (isset($collections[$key])) {
-                unset($this->databases[$name][$key]);
+            if (isset($collections[$filtered]) && $collections[$filtered] === $key) {
+                unset($this->databases[$name][$filtered]);
             }
         }
 
@@ -912,10 +913,14 @@ public function updateDocument(Document $collection, string $id, Document $docum
         $this->data[$key]['documents'][$newKey] = $row;
 
         if (! $skipPermissions) {
-            // Remove any permissions keyed to the old uid and rewrite.
+            // Remove any permissions keyed to the old uid (within the
+            // current tenant only — other tenants may legitimately hold a
+            // permission for the same $id under shared tables) and rewrite.
+            $tenant = $this->getTenant();
             $this->permissions[$key] = \array_values(\array_filter(
                 $this->permissions[$key],
-                fn (array $p) => $p['document'] !== $id && $p['document'] !== $newId
+                fn (array $p) => ($this->sharedTables && ($p['tenant'] ?? null) !== $tenant)
+                    || ($p['document'] !== $id && $p['document'] !== $newId)
             ));
             $this->writePermissions($key, $document);
         } elseif ($newId !== $id) {
@@ -949,7 +954,10 @@ public function updateDocuments(Document $collection, Document $updates, array $
             return 0;
         }
 
-        $count = 0;
+        // Two-phase: validate every row (including unique-index checks)
+        // before any write lands, so a uniqueness violation on document N
+        // does not leave documents 0..N-1 partially committed.
+        $prepared = [];
         foreach ($documents as $doc) {
             $uid = $doc->getId();
             $docKey = $this->documentKey($uid);
@@ -971,6 +979,15 @@ public function updateDocuments(Document $collection, Document $updates, array $
                 $this->enforceUniqueIndexes($key, $merged, $uid);
             }
 
+            $prepared[] = ['uid' => $uid, 'docKey' => $docKey, 'attrs' => $resolvedAttrs];
+        }
+
+        $tenant = $this->getTenant();
+        foreach ($prepared as $entry) {
+            $uid = $entry['uid'];
+            $docKey = $entry['docKey'];
+            $resolvedAttrs = $entry['attrs'];
+
             $row = &$this->data[$key]['documents'][$docKey];
             foreach ($resolvedAttrs as $attribute => $value) {
                 if (\is_array($value)) {
@@ -989,24 +1006,24 @@ public function updateDocuments(Document $collection, Document $updates, array $
                 $row['_permissions'] = \json_encode($updates->getPermissions());
                 $this->permissions[$key] = \array_values(\array_filter(
                     $this->permissions[$key],
-                    fn (array $p) => $p['document'] !== $uid
+                    fn (array $p) => ($this->sharedTables && ($p['tenant'] ?? null) !== $tenant)
+                        || $p['document'] !== $uid
                 ));
                 foreach (Database::PERMISSIONS as $type) {
                     foreach ($updates->getPermissionsByType($type) as $permission) {
                         $this->permissions[$key][] = [
                             'document' => $uid,
                             'type' => $type,
                             'permission' => \str_replace('"', '', $permission),
-                            'tenant' => $this->getTenant(),
+                            'tenant' => $tenant,
                         ];
                     }
                 }
             }
-            $count++;
             unset($row);
         }
 
-        return $count;
+        return \count($prepared);
     }
 
     public function upsertDocuments(Document $collection, string $attribute, array $changes): array
@@ -1052,9 +1069,11 @@ public function deleteDocument(string $collection, string $id): bool
         }
 
         unset($this->data[$key]['documents'][$docKey]);
+        $tenant = $this->getTenant();
         $this->permissions[$key] = \array_values(\array_filter(
             $this->permissions[$key] ?? [],
-            fn (array $p) => $p['document'] !== $id
+            fn (array $p) => ($this->sharedTables && ($p['tenant'] ?? null) !== $tenant)
+                || $p['document'] !== $id
         ));
 
         return true;
@@ -1093,9 +1112,11 @@ public function deleteDocuments(string $collection, array $sequences, array $per
             : [];
 
         if (! empty($deletedIds) || ! empty($permSet)) {
+            $tenant = $this->getTenant();
             $this->permissions[$key] = \array_values(\array_filter(
                 $this->permissions[$key] ?? [],
-                fn (array $p) => ! isset($deletedIds[$p['document']]) && ! isset($permSet[$p['document']])
+                fn (array $p) => ($this->sharedTables && ($p['tenant'] ?? null) !== $tenant)
+                    || (! isset($deletedIds[$p['document']]) && ! isset($permSet[$p['document']]))
             ));
         }
 
@@ -2183,7 +2204,6 @@ protected function matchesObject(mixed $value, Query $query): bool
 
             case Query::TYPE_CONTAINS:
             case Query::TYPE_CONTAINS_ANY:
-            case Query::TYPE_CONTAINS_ALL:
                 if ($haystack === null) {
                     return false;
                 }
@@ -2195,6 +2215,18 @@ protected function matchesObject(mixed $value, Query $query): bool
 
                 return false;
 
+            case Query::TYPE_CONTAINS_ALL:
+                if ($haystack === null) {
+                    return false;
+                }
+                foreach ($values as $candidate) {
+                    if (! $this->jsonContains($haystack, $this->wrapScalarObjectValue($candidate))) {
+                        return false;
+                    }
+                }
+
+                return true;
+
             case Query::TYPE_NOT_CONTAINS:
                 if ($haystack === null) {
                     return true;