Laravel-mongodb: Password Reset errors [1 fix/other open]

[microwavekonijn]

I just started working with this package, not disappointed so far. However when enabling the PasswordResetServiceProvider I encountered an error when requesting a new password.

In the file Jenssegers/Mongodb/Auth/PasswordBrokerManager.php the method createTokenRepository creates an instance of the DatabaseTokenRepository. However the second argument should be a hash. I copied te code form the original method so the function looks like this:

protected function createTokenRepository(array $config)
    {
        $key = $this->app['config']['app.key'];

        if (Str::startsWith($key, 'base64:')) {
            $key = base64_decode(substr($key, 7));
        }

        $connection = isset($config['connection']) ? $config['connection'] : null;

        return new DatabaseTokenRepository(
            $this->app['db']->connection($connection),
            $this->app['hash'],
            $config['table'],
            $key,
            $config['expire']
        );

I tried it and it send the mail as expected.

Also when you have received the password reset email. When you have entered your email and new password a new error occurs.

FatalThrowableError in DatabaseTokenRepository.php line 24:
Cannot use object of type MongoDB\BSON\UTCDateTime as array

I think this is because the tokeExpired method expects and $createdAt parameter and receives a $token parameter. I can only assume that those two mean different things.

I used Laravel 5.4.23 when debugging this problem.

[microwavekonijn]

For the second problem I think this it a fix:

protected function tokenExpired($createdAt)
    {

//         Convert UTCDateTime to a date string.
        if ($createdAt instanceof UTCDateTime) {
            $date = $createdAt->toDateTime();
            $date->setTimezone(new DateTimeZone(date_default_timezone_get()));
            $createdAt = $date->format('Y-m-d H:i:s');
        } elseif (is_array($createdAt) and isset($createdAt['date'])) {
            $date = new DateTime($createdAt['date'], new DateTimeZone(isset($createdAt['timezone']) ? $createdAt['timezone'] : 'UTC'));
            $date->setTimezone(new DateTimeZone(date_default_timezone_get()));
            $createdAt = $date->format('Y-m-d H:i:s');
        }

        return parent::tokenExpired($createdAt);
    }

[microwavekonijn]

No errors now, but it tells me the that the token is invalid. Any ideas?

"This password reset token is invalid."

[D-02022020]

you do not need to copy the complete original code, simply insert the missing method argument

protected function createTokenRepository(array $config)
{
    return new DatabaseTokenRepository(
        $this->app['db']->connection(),
        $this->app['hash'],
        $config['table'],
        $this->app['config']['app.key'],
        $config['expire']
    );
}

this removed the Argument 2 ... must implement interface Illuminate\Contracts\Hashing\Hasher, string given error for me, however I didn't test yet whether the tokens are valid then

[microwavekonijn]

For the token invalid I found that you also need to change getPayload method from the DatabaseTokenRepository to

protected function getPayload($email, $token)
    {
        return ['email' => $email, 'token' => $this->hasher->make($token), 'created_at' => new UTCDateTime(time() * 1000)];
    }

Yeah, you don't have to, but I it is better to keep to the original code in case you miss something.

[mostafamaklad]

Please Reopen the issue as there is no commit resolve it yet

[alexjose]

Any update on this issue?

[StevePorter92]

Have you registered the Password reset service provider?

'Jenssegers\Mongodb\Auth\PasswordResetServiceProvider',

[raphael-thibierge]

I registered the PasswordResetServiceProvider and have the same problem
config : Laravel 5.5.* and jessengers/mongodb ^3.3

[kevindesousa]

The same as @raphael-thibierge ...
Any solutions ?

[microwavekonijn]

I think the error comes, because the method tokenExpired in the DatabaseTokenRepository class still accepts a $token and expects $token['created_at'] to be set. But the parameter passed to the method is actually a date not an array. So the problem has still not been resolved.

Solution is in my second message in this issue.

[kevindesousa]

Yes, you're right, Thanks !
Do you have a better solutions to integrate this fix without modify vendor ?
(How to override the vendor ?)

[microwavekonijn]

There is a way, but it is kind of a hacky way. Create a map called fixes and then add in the composer.json file in the psr-4 array a entry called "Jenssegers\\Mongodb\\": "fixes/Jenssegers/Mongodb/". Then take the files you want to replace like the DatabaseTokenRepository.php and add it to fixed/Jenssegers/Mongodb/Auth/DatabaseTokeRepository.php. Then you have to reset composer, by deleting composer.lock and install composer again. And it should work.

[kevindesousa]

Thank you a lot !!! :)

[Icet00]

@microwavekonijn you solution works for me. Thank you. But for the solution without vendor, where do you create the map called fixes ? And is there a reason why you use fixes for all name and we only name the directory fixed ?

[microwavekonijn]

The fixes map you create in the same directory as the composer.json file. Fixed should be fixes, just a typo.

[Icet00]

Sorry, I've never modified a composer.json. Should I have something like that ?
{
"name": "laravel/laravel",
...
"fixes":
{
"psr-4": {
"Jenssegers\Mongodb\": "fixes/Jenssegers/Mongodb/"
}
}
}

And my repository "fixes" should be in the root folder ? like myproject//Jenssegers/Mongodb/Auth/DatabaseTokeRepository.php

For the moment, that doesn't work with this config. Shoud I change which class I use from the user.php ? like use fixes\Jenssegers\Mongodb\Auth\User as Authenticatable.

Thank you for helping me.

[microwavekonijn]

The composer.json after a fresh install has a part that looks exactly like this

...
"psr-4": {
    "App\\": "app/"
}
...

Just change it to this

...
"psr-4": {
    "App\\": "app/",
    "Jenssegers\\Mongodb\\": "fixes/Jenssegers/Mongodb/"
}
...

In the same directory as composer.json create a new directory called fixes. If you want to change Jenssegers/Mongodb/Auth/DatabaseTokenRepository.php, then create the directories and the file such that you will have fixes/Jenssegers/Mongodb/Auth/DatabaseTokenRepository.php. Then delete the composer.lock file and install composer again.

The namespaces will still remain the same. How the autoload will work it will prioritize the fixes over the package files/classes.

Update: Don't reïnstall Composer or delete composer.lock. Instead use the rebuild command, this will only rebuild the autoloader.

[Icet00]

Thank you. It's working :)

[Ravaelles]

I just want to wrap up the conversation above and leave a complete fix file that restored the functionality, for me (Laravel 5.5), here it is:
https://gist.github.com/Ravaelles/3878d82117d2881c03ee02e036cc67cb

You also need to update the composer file, read closely microwavekonijn's post two messages above this one.

[marcnewton]

Why has the working fixes for password resets that currently reside in the master branch not been published to packagist @jenssegers ?

The current latest published version v3 package is 3.4.2 and contains the bad DatabaseTokenRepository & PasswordBrokerManager files.

Diff on 3.4.2 and master shows those files are the only 2 remaining unpublished changes and seem to work.

Should these fixes have not been published as v3.4.3 to packagist?