[13.x] Fix broken token relation when auth identifier is not PK

[axlon]

Passport refers to users through their auth identifier, similarly to guards and session handlers found in the framework itself. Normally this is also the user's primary key, but if a developer opts to use a different column as the auth identifier Passport will break, because while it stores the user's auth identifier it tries to look up tokens through the user's primary key.

This PR fixes this by making the tokens() relation use the auth identifier.

Passport already uses the auth identifier in most places, but it seems it isn't doing it consistently:

• passport/src/Token.php

  Line 83 in 951fe86

  return $this->belongsTo($model, 'user_id', (new $model)->getAuthIdentifierName());

• passport/src/Passport.php

  Line 352 in 951fe86

  'oauth_user_id' => $user->getAuthIdentifier(),

This should not be a breaking change because the auth identifier is set to the primary key by default. If the developer was already using a different key Passport would already not work.

Related PR:

• [9.x] Switch from getKey() to getAuthIdentifier() to match Laravel core #1134

[hafezdivandari]

The change on tokens relation seems correct as it is based on auth identifier, actually user_id is not proper name here, it actually refers to resource owner and depends on the auth provider (i.e. client's provider)

But the change on oauthApps relation seems incorrect, you may also check the revers relation, as it is based on the model key and has nothing to do with the auth ID?

Also the change on the clients relation, I don't recommend as it may be a breaking change, this relation was wrong from the beginning, that's why it is deprecated in favor of the new oauthApps relation.

[axlon]

@hafezdivandari good catch! I had some local changes where I was explicitly passing the auth identifier into these related models, which led to the mistake

[hafezdivandari]

But the changes are still there, you may consider reverting those changes on clients and oauthApps?

[axlon]

But the changes are still there, you may consider reverting those changes on clients and oauthApps?

🤦‍♂️ I thought I reverted them before, should be fixed now!