Overriding Model Token fails

[PicassoHouessou]

Passport Version

13.0.3

Laravel Version

12

PHP Version

8.3.21

Database Driver & Version

No response

Description

When I tried to override the default model for Token, it failed.

Steps To Reproduce

// app/Models/AccessToken.php

<?php

namespace App\Models;

use Laravel\Passport\Token   as PassportToken;

class AccessToken extends PassportToken
{
}

// App Service Provider

<?php

namespace App\Providers;

use App\Models\AccessToken; 
use Illuminate\Support\ServiceProvider; 
 

class AppServiceProvider extends ServiceProvider
{
    /**
     * Register any application services.
     */
    public function register(): void
    {
        Passport::ignoreRoutes();

    }

    /**
     * Bootstrap any application services.
     */
    public function boot(): void
    {
        Passport::useTokenModel(AccessToken::class);
    }
}

[hafezdivandari]

Couldn't reproduce the issue, would you please write a failing test?

[PicassoHouessou]

@hafezdivandari
Sorry, I saw the cause of the error: it happened when I added API Platform to the project.
This code triggers the error, but I don't know why.

<?php

namespace App\Models;

use Laravel\Passport\Token as PassportToken;
use ApiPlatform\Metadata\ApiResource;

#[ApiResource()]
class AccessToken extends PassportToken
{
}

I have installed API Platform:

composer require api-platform/laravel
php artisan api-platform:install

[hafezdivandari]

It seems to be incomplete/wrong setup. Your access token doesn't have a client associated that should never happen when issuing a token with Passport. Also I don't understand why you want to have the TokenModel as an API resource?

Nothing I can do without having a failing test here, you may try their issue board or QA forums first.

[PicassoHouessou]

Typically, I wouldn’t expose the TokenModel as an API resource, but I was just testing when I encountered this issue.

I’ve pushed the relevant content here: https://github.com/PicassoHouessou/token-model-fails.

[hafezdivandari]

Again, it's an incomplete/wrong setup. E.g you don't have api guard added here, your User model doesn't have HasApiTokens trait as instructed by docs, and you are probabley creating the token manually without associating a client to it.

[grEvenX]

@hafezdivandari I have a similar issue, we extend the Laravel\Passport\Token (as allowed from Passport::useTokenModel()). From me this looks like a bug in the Laravel Passport code, but I might very well be wrong. Even without extending the token model, you can experience the issue by trying to write a query for the Token class that invokes the user relation.

The Token.php code has the following implementation:

    /**
     * Get the user that the token belongs to.
     *
     * @deprecated Will be removed in a future Laravel version.
     *
     * @return \Illuminate\Database\Eloquent\Relations\BelongsTo<\Illuminate\Foundation\Auth\User, $this>
     */
    public function user(): BelongsTo
    {
        $provider = $this->client->provider ?: config('auth.guards.api.provider');
        $model = config('auth.providers.'.$provider.'.model');
        return $this->belongsTo($model, 'user_id', (new $model)->getAuthIdentifierName());
    }

Based on my knowledge, the code assumes that $this->client is already set (a null value will cause an exception here), which would never be the case if using this relation in a query builder?
If the method wasn't a Builder method it would be completely valid, but $this->client will never be not-null in this case if the model hasn't been hydrated yet (unless I'm missing something that will ensure this is always injected to the model even when used from a query builder context?

Here's a simple query that shows an example query using the Laravel\Passport\Token class which should be a valid query but fails with an exception:

<?php
declare(strict_types=1);

use Laravel\Passport\Token;

test('is able to query for tokens using the user relation', function () {
    Token::query()->whereHas('user', function ($query) {
        $query->where('name', 'test');
    });
    expect(true)->toBeTrue();
});

Running this test for me causes the following exception:

ErrorException: Attempt to read property "provider" on null

If this information is correct, I believe there is a similar issue (but not as critical since it won't cause exceptions) in Laravel\Passport\Client for the user() relation there (assumes $this->provider is set).

[hafezdivandari]

@grEvenX but the user() method is deprecated? Just don't use it?

[korridor]

I had the same issue, but I'm not completely sure why it happened. I fixed it by copying the content of the user() function in the child model and added only a ? after $this->client to make it null-safe.

   /**
     * Get the user that the token belongs to.
     *
     * @deprecated Will be removed in a future Laravel version.
     *
     * @return BelongsTo<User, $this>
     */
    public function user(): BelongsTo
    {
        $provider = $this->client?->provider ?: config('auth.guards.api.provider');

        $model = config('auth.providers.'.$provider.'.model');

        return $this->belongsTo($model, 'user_id', (new $model)->getAuthIdentifierName());
    }

I'll investigate further.

[korridor]

@grEvenX but the user() method is deprecated? Just don't use it?

The whole point of making something "deprecated" instead of just removing it, is so that you can still use it.

[hafezdivandari]

First, this issue is not related to overriding the AccessToken model, that works fine.

Regarding the Token::user() relation issue, it's deprecated because it’s not a standard relation and doesn’t work reliably. You can’t define a simple relation for it, since the actual user model depends on the token’s client. See the reverse relation here for context:

passport/src/HasApiTokens.php

Lines 43 to 62 in d1c21a2

	/**
	* Get all of the access tokens for the user.
	*
	* @return \Illuminate\Database\Eloquent\Relations\HasMany<\Laravel\Passport\Token, $this>
	*/
	public function tokens(): HasMany
	{
	return $this->hasMany(Passport::tokenModel(), 'user_id', $this->getAuthIdentifierName())
	->where(function (Builder $query): void {
	$query->whereHas('client', function (Builder $query): void {
	$query->where(function (Builder $query): void {
	$provider = $this->getProviderName();
	$query->when($provider === config('auth.guards.api.provider'), function (Builder $query): void {
	$query->orWhereNull('provider');
	})->orWhere('provider', $provider);
	});
	});
	});
	}

The HasApiTokens trait can be used on any Authenticatable model (e.g. User, Admin, Customer, etc.). The relation between an access token and an authenticatable instance depends on the token’s client provider. This doesn't work on the query builder, because it is impossible to join across different user provider tables dynamically!

Also, using ?->provider is unsafe and can cause security issues by falling back to the default user provider. Avoid it.

Keep in mind, there’s a reason behind the exception you're seeing. If you find yourself needing to query tokens "by user," it’s likely a design flaw in your usage.

Possible solution: Use the reverse relation like $user->tokens(). Also check the "Managing Tokens" and "Revoking Tokens" sections of the documentation for some common example usages.