New version 2.0.18 deletes users on loging

cartalyst / sentinel

A framework agnostic authentication & authorization system.

BSD 3-Clause "New" or "Revised" License

1.51k stars 238 forks source link

New version 2.0.18 deletes users on loging #482

Closed rubenvl2 closed 5 years ago

rubenvl2 commented 5 years ago

With the new release 2.0.18 all our auth login fail because throttling seems not working (we dont get any error) but the user gets directly deleted, and, of course, cannot complete the login.

We rolledback to v2.0.17 (it was our stage environment) and everything worked back.

Thanks.

brunogaspar commented 5 years ago

Please paste some code that causes this so i can try to reproduce the problem.

rubenvl2 commented 5 years ago

Hi @brunogaspar, unfortunately this time we don't have any code to provide. I explain you how was the issue:

We did a deployment of our platform in a stage environment we use often for work, we use jenkins, and this run a full composer install.
The version of sentinel that composer took was 2.0.18 instead of the 2.0.17 we have in production.
From that moment on, everytime we tried to login, either from our admin panel, either from our api (that uses sentinel login), the user will get directly deleted (softdeletes).

Once we identified that sentinel was updated, we went back to 2.0.17, checked again, and everything works smooth.

I apologize I cannot provide you with better debugging that this :S But I suppose more users will start experiencing this and can provide more info in this threat.

Thanks.

brunogaspar commented 5 years ago

I tried with a simple app yesterday, couldn't reproduce any login issue nor i'm seeing how Sentinel is soft deleting a user because Sentinel User model does not ship with soft deletes.

When you upgraded your dependencies, what did it update also? When you downgraded Sentinel, you downgraded only Sentinel or everything?

Just trying to pin point what might be wrong but unfortunately without a piece of code to analyse and perhaps reproduce the problem, i can't really help much as my quick test app allows me login as expected :\

rubenvl2 commented 5 years ago

@brunogaspar of course I understand you. Thank you so much for helping with this, I appreciate it.

I will ask some of our enginners to come to this threath and put more detail. Eventually, once we finish our urgent backlog, we will go back to 2.0.18 and try to debug step by step. Just keep this post open if you want till someone else experiences.

Thanks!

brunogaspar commented 5 years ago

Just keep this post open if you want till someone else experiences.

Of course, it's a bug report, until we figure out where the problem is, it stays open, no worries.

I've checked the changes between 2.0.17 and 2.0.18 and couldn't pin point what might changed that's causing this weird behaviour. If it was just not logging in, we could try different things, but you're saying it's deleting the User (soft deleting) that's what i don't really understand.

brunogaspar commented 5 years ago

@rubenvl2 Any news?

nicolaeum commented 5 years ago

@brunogaspar after a deep debugging we noticed the soft delete applied to our model is our fault but it just popped up after the last package update. Sorry for alarming you.

After triggering $this->fireEvent('sentinel.logging-in', $user); on the login method of the Sentinel class (src/Sentinel.php), for some reason our model is using a getter which is a little buggy.

Thanks for your patience, sorry for the delay and the wrong report.

Cheers

Nico

brunogaspar commented 5 years ago

hmm interesting..

Do you want to share that getter or the entire class so i can evaluate? You can email me the file for privacy and if interested of course :)

brunogaspar commented 5 years ago

Closing due to lack of activity. Feel free to reopen if you still have issues.