v1.61.2

[1.61.2] - 2026-06-23 — Wezen

Theme: permission gate fail-closed fix. Every #[RequiresPermission] / gate_permissions route returned 403 for fully authorized users because the auth.user principal the gate reads was never populated — AuthMiddleware's enricher lookup used a leading-backslash container id that never matched, so the enricher silently never ran. The gate then saw a null principal and denied. Plus a companion cache-key fix so file/Memcached backends accept the framework's colon-namespaced keys (login could fail on those drivers). Patch release — bugfixes, no new env, no migrations, no action required.

Fixed

• #[RequiresPermission] routes no longer fail closed (403) when the auth-attribute enricher is registered. AuthMiddleware::autoEnrichRequest() looked the enricher up by a leading-backslash string id ('\Glueful\Permissions\Middleware\AuthToRequestAttributesMiddleware'), but the container registers it under the ::class form (no leading backslash) and does not normalize the two. Container::has() therefore returned false, the enricher never ran, and the auth.user UserIdentity it sets was never populated — so GateAttributeMiddleware (which every #[RequiresPermission] / gate_permissions route relies on) saw a null principal and returned 403 for every permissioned request, even for a fully authorized user. The lookup now uses AuthToRequestAttributesMiddleware::class, matching the container key. No new env, no migrations.
• File and Memcached cache drivers no longer reject colon-namespaced keys. FileCacheDriver and MemcachedCacheDriver listed : among PSR-16's reserved characters and threw CacheException::invalidCharacters on any key containing one. But the framework namespaces every cache key with a colon (session:, provider:, user_permissions:, user_sessions:), so logging in on a file (or Memcached) cache backend failed with Cache key 'session:…' contains invalid characters the moment SessionCacheManager tried to store the session. Both drivers now allow : (the file driver md5-hashes the key into the filename, so it is filesystem-safe; colons are valid Memcached keys), matching RedisCacheDriver, which already permitted it. No new env, no migrations.