feat: v2 evaluation engine — resolver chain, conditions, resource policies

.github/workflows/ci.yml

@@ -2,18 +2,33 @@ name: CI
 
 on:
   pull_request:
+    paths-ignore:
+      - '**/*.md'
+      - 'docs/**'
+      - 'LICENSE'
+
+env:
+  COMPOSER_PROCESS_TIMEOUT: 0
+  COMPOSER_NO_INTERACTION: 1
+  COMPOSER_NO_AUDIT: 1
 
 jobs:
   lint:
     name: Lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - uses: shivammathur/setup-php@v2
         with:
           php-version: '8.4'
 
+      - uses: actions/cache@v5
+        with:
+          path: vendor
+          key: composer-lint-${{ hashFiles('composer.json') }}
+          restore-keys: composer-lint-
+
       - run: composer install --no-interaction
 
       - run: vendor/bin/pint --test
@@ -23,12 +38,18 @@ jobs:
     needs: lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - uses: shivammathur/setup-php@v2
         with:
           php-version: '8.4'
 
+      - uses: actions/cache@v5
+        with:
+          path: vendor
+          key: composer-static-${{ hashFiles('composer.json') }}
+          restore-keys: composer-static-
+
       - run: composer install --no-interaction
 
       - run: vendor/bin/phpstan analyse
@@ -43,22 +64,28 @@ jobs:
         php: ['8.4', '8.5']
         laravel: ['12', '13']
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - uses: shivammathur/setup-php@v2
         with:
           php-version: ${{ matrix.php }}
           coverage: pcov
           extensions: redis
 
+      - uses: actions/cache@v5
+        with:
+          path: vendor
+          key: composer-test-${{ matrix.php }}-${{ matrix.laravel }}-${{ hashFiles('composer.json') }}
+          restore-keys: composer-test-${{ matrix.php }}-${{ matrix.laravel }}-
+
       - run: composer require illuminate/support:^${{ matrix.laravel }}.0 --no-update
       - run: composer update --no-interaction
 
-      - run: docker compose -f docker-compose.test.yml up -d --wait valkey
+      - run: docker compose up -d --wait valkey
 
-      - run: vendor/bin/pest --coverage --min=90
+      - run: vendor/bin/pest --exclude-group=benchmark --coverage --min=90
 
-      - run: docker compose -f docker-compose.test.yml down -v
+      - run: docker compose down -v
 
   test-database:
     name: Tests (${{ matrix.database }} / PHP ${{ matrix.php }} / Laravel ${{ matrix.laravel }})
@@ -69,20 +96,26 @@ jobs:
       matrix:
         php: ['8.4', '8.5']
         laravel: ['12', '13']
-        database: [pgsql, mysql]
+        database: [pgsql]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - uses: shivammathur/setup-php@v2
         with:
           php-version: ${{ matrix.php }}
-          extensions: redis, pdo_pgsql, pdo_mysql
+          extensions: redis, pdo_pgsql
+
+      - uses: actions/cache@v5
+        with:
+          path: vendor
+          key: composer-db-${{ matrix.php }}-${{ matrix.laravel }}-${{ hashFiles('composer.json') }}
+          restore-keys: composer-db-${{ matrix.php }}-${{ matrix.laravel }}-
 
       - run: composer require illuminate/support:^${{ matrix.laravel }}.0 --no-update
       - run: composer update --no-interaction
 
-      - run: docker compose -f docker-compose.test.yml up -d --wait ${{ matrix.database }} valkey
+      - run: docker compose up -d --wait postgres valkey
 
-      - run: DB_CONNECTION=${{ matrix.database }} vendor/bin/pest
+      - run: DB_CONNECTION=${{ matrix.database }} vendor/bin/pest --exclude-group=benchmark
 
-      - run: docker compose -f docker-compose.test.yml down -v
+      - run: docker compose down -v

.gitignore

@@ -13,4 +13,5 @@ composer.lock
 .claude/
 CLAUDE.md
 /backlog
-/docs/superpowers
+/docs/superpowers
+.worktrees/

README.md

@@ -1,5 +1,9 @@
 # Policy Engine for Laravel
 
+[![Pint](https://img.shields.io/github/actions/workflow/status/dynamik-dev/laravel-policy-engine/ci.yml?branch=main&label=Pint&logo=laravel)](https://github.com/dynamik-dev/laravel-policy-engine/actions/workflows/ci.yml)
+[![Larastan](https://img.shields.io/github/actions/workflow/status/dynamik-dev/laravel-policy-engine/ci.yml?branch=main&label=Larastan&logo=php)](https://github.com/dynamik-dev/laravel-policy-engine/actions/workflows/ci.yml)
+[![Pest](https://img.shields.io/github/actions/workflow/status/dynamik-dev/laravel-policy-engine/ci.yml?branch=main&label=Pest&logo=php)](https://github.com/dynamik-dev/laravel-policy-engine/actions/workflows/ci.yml)
+
 An IAM-style policy engine for Laravel. Define your authorization as declarative JSON documents and import them the way you'd manage AWS IAM policies.
 
 ```json
@@ -106,16 +110,15 @@ Every component is coded to a PHP interface. Swap any implementation via the ser
 
 ## Requirements
 
-| Dependency | Supported Versions |
-|---|---|
-| PHP | 8.4, 8.5 |
-| Laravel | 12, 13 |
-| PostgreSQL | 17+ |
-| MySQL | 8.4+ |
-| SQLite | 3.35+ |
-| Valkey / Redis | 8+ |
+| Dependency     | Supported Versions |
+| -------------- | ------------------ |
+| PHP            | 8.4, 8.5           |
+| Laravel        | 12, 13             |
+| PostgreSQL     | 17+                |
+| SQLite         | 3.35+              |
+| Valkey / Redis | 8+                 |
 
-SQLite works out of the box for development. PostgreSQL, MySQL, and Valkey are optional — the package tests against all of them in CI.
+SQLite works out of the box for development. PostgreSQL and Valkey are optional — the package tests against both in CI. MySQL is not officially supported but should work fine since Laravel's query builder abstracts the differences.
 
 ## Documentation
 

composer.json

@@ -23,9 +23,9 @@
         "laravel/pint": "^1.27",
         "laravel/sanctum": "^4.3",
         "orchestra/testbench": "^10.0|^11.0",
-        "pestphp/pest": "^3.0",
-        "pestphp/pest-plugin-laravel": "^3.0",
-        "pestphp/pest-plugin-mutate": "^3.0"
+        "pestphp/pest": "^4.0",
+        "pestphp/pest-plugin-laravel": "^4.0",
+        "pestphp/pest-plugin-mutate": "^4.0"
     },
     "autoload": {
         "psr-4": {

config/policy-engine.php

@@ -2,44 +2,32 @@
 
 declare(strict_types=1);
 
+use DynamikDev\PolicyEngine\Resolvers\BoundaryPolicyResolver;
+use DynamikDev\PolicyEngine\Resolvers\IdentityPolicyResolver;
+use DynamikDev\PolicyEngine\Resolvers\ResourcePolicyResolver;
+use DynamikDev\PolicyEngine\Resolvers\SanctumPolicyResolver;
+
 return [
     'cache' => [
         'enabled' => true,
-
-        // WARNING: If your cache driver does not support tags (file, database),
-        // policy-engine uses generation counters for invalidation. Entries expire
-        // naturally via TTL rather than being deleted immediately. For instant
-        // invalidation, use a tagged driver (Redis, Memcached).
         'store' => env('POLICY_ENGINE_CACHE_STORE', 'default'),
-
-        // TTL in seconds.
-        // Lower values reduce the window for stale cached permissions after revocation.
         'ttl' => 60 * 5,
     ],
     'protect_system_roles' => true,
     'log_denials' => true,
-    'explain' => env('POLICY_ENGINE_EXPLAIN', false),
+    'trace' => env('POLICY_ENGINE_TRACE', false),
     'deny_unbounded_scopes' => false,
-
-    // When true, boundary checks are applied even for unscoped (global)
-    // evaluations. By default, global assignments are inherently unbounded —
-    // boundaries only restrict scoped checks. Enable this if you need to
-    // enforce boundary ceilings on global permission checks. Be aware that
-    // this requires boundaries to exist for every scope the subject might
-    // access, which may cause unexpected denials.
     'enforce_boundaries_on_global' => false,
-
-    // Prefix prepended to all policy-engine table names. Useful when another
-    // package (e.g. Spatie Permission, Bouncer) already uses generic names
-    // like "permissions" or "roles". Set to 'pe_' for new installs alongside
-    // other permission packages. Empty string preserves backwards compatibility.
     'table_prefix' => '',
-
-    // The seeder class used by the policy-engine:sync command.
-    // Must be resolvable by db:seed --class (typically in Database\Seeders namespace).
     'seeder_class' => 'PermissionSeeder',
-
     'document_path' => null,
     'gate_passthrough' => [],
     'import_subject_types' => [],
+
+    'resolvers' => [
+        IdentityPolicyResolver::class,
+        BoundaryPolicyResolver::class,
+        ResourcePolicyResolver::class,
+        SanctumPolicyResolver::class,
+    ],
 ];

database/migrations/0009_create_resource_policies_table.php

@@ -0,0 +1,33 @@
+<?php
+
+declare(strict_types=1);
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        $prefix = config('policy-engine.table_prefix', '');
+
+        Schema::create($prefix.'resource_policies', function (Blueprint $table): void {
+            $table->ulid('id')->primary();
+            $table->string('resource_type');
+            $table->string('resource_id')->nullable();
+            $table->string('effect');
+            $table->string('action');
+            $table->string('principal_pattern')->nullable();
+            $table->json('conditions')->nullable();
+            $table->timestamps();
+
+            $table->index(['resource_type', 'resource_id']);
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::dropIfExists(config('policy-engine.table_prefix', '').'resource_policies');
+    }
+};

docker-compose.yml

@@ -1,6 +1,24 @@
 services:
-  test:
-    build:
-      context: .
-      dockerfile: docker/Dockerfile
-    command: vendor/bin/pest --coverage
+  valkey:
+    image: valkey/valkey:8-alpine
+    ports:
+      - "6379:6379"
+    healthcheck:
+      test: ["CMD", "valkey-cli", "ping"]
+      interval: 2s
+      timeout: 3s
+      retries: 5
+
+  postgres:
+    image: postgres:17-alpine
+    ports:
+      - "5432:5432"
+    environment:
+      POSTGRES_DB: policy_engine_test
+      POSTGRES_USER: test
+      POSTGRES_PASSWORD: test
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U test"]
+      interval: 2s
+      timeout: 3s
+      retries: 5