Bug: Registration doesn't work: "$user->id is null. You should not use the incomplete User object."

[iamsyh]

PHP Version

8.1

CodeIgniter4 Version

4.3.2

Shield Version

latest dev branch c561109

Which operating systems have you tested for this bug?

Linux

Which server did you use?

apache

Database

MySQL

Did you customize Shield?

No

What happened?

When you try to register via the default registration form, an error occurs:

CRITICAL - 2023-03-02 18:35:46 --> "$user->id" is null. You should not use the incomplete User object.
in /home/mydir/vendor/codeigniter4/shield/src/Models/UserIdentityModel.php on line 85.
1 /home/mydir/vendor/codeigniter4/shield/src/Models/UserIdentityModel.php(235): CodeIgniter\Shield\Models\UserIdentityModel->checkUserId(Object(CodeIgniter\Shield\Entities\User))
2 /home/mydir/vendor/codeigniter4/shield/src/Entities/User.php(87): CodeIgniter\Shield\Models\UserIdentityModel->getIdentities(Object(CodeIgniter\Shield\Entities\User))
3 /home/mydir/vendor/codeigniter4/shield/src/Entities/User.php(101): CodeIgniter\Shield\Entities\User->populateIdentities()
4 /home/mydir/vendor/codeigniter4/shield/src/Entities/User.php(72): CodeIgniter\Shield\Entities\User->getIdentities('email_password')
5 /home/mydir/vendor/codeigniter4/shield/src/Entities/User.php(140): CodeIgniter\Shield\Entities\User->getIdentity('email_password')
6 /home/mydir/vendor/codeigniter4/shield/src/Entities/User.php(220): CodeIgniter\Shield\Entities\User->getEmailIdentity()
7 SYSTEMPATH/Entity/Entity.php(493): CodeIgniter\Shield\Entities\User->getEmail()
8 /home/mydir/vendor/codeigniter4/shield/src/Authentication/Passwords/NothingPersonalValidator.php(58): CodeIgniter\Entity\Entity->__get('email')
9 /home/mydir/vendor/codeigniter4/shield/src/Authentication/Passwords/NothingPersonalValidator.php(27): CodeIgniter\Shield\Authentication\Passwords\NothingPersonalValidator->isNotPersonal('nh8tve37abhcfux', Object(CodeIgniter\Shield\Entities\User))
10 /home/mydir/vendor/codeigniter4/shield/src/Authentication/Passwords.php(103): CodeIgniter\Shield\Authentication\Passwords\NothingPersonalValidator->check('nh8tve37abhcfux', Object(CodeIgniter\Shield\Entities\User))
11 /home/mydir/vendor/codeigniter4/shield/src/Authentication/Passwords/ValidationRules.php(45): CodeIgniter\Shield\Authentication\Passwords->check('nH8tve37abHCfUX', Object(CodeIgniter\Shield\Entities\User))
12 SYSTEMPATH/Validation/Validation.php(311): CodeIgniter\Shield\Authentication\Passwords\ValidationRules->strong_password('nH8tve37abHCfUX', null)
13 SYSTEMPATH/Validation/Validation.php(170): CodeIgniter\Validation\Validation->processRules('password', 'Auth.password', 'nH*8tve37abHCfUX', [...], [...])
14 SYSTEMPATH/Controller.php(140): CodeIgniter\Validation\Validation->run()
15 /home/mydir/vendor/codeigniter4/shield/src/Controllers/RegisterController.php(102): CodeIgniter\Controller->validate([...])
16 SYSTEMPATH/CodeIgniter.php(934): CodeIgniter\Shield\Controllers\RegisterController->registerAction()
17 SYSTEMPATH/CodeIgniter.php(499): CodeIgniter\CodeIgniter->runController(Object(CodeIgniter\Shield\Controllers\RegisterController))
18 SYSTEMPATH/CodeIgniter.php(368): CodeIgniter\CodeIgniter->handleRequest(null, Object(Config\Cache), false)
19 FCPATH/index.php(67): CodeIgniter\CodeIgniter->run()

Steps to Reproduce

1. Comment out email from $validFields array in Config/Auth.php
2. Keep/Add NothingPersonalValidator to $passwordValidators in the same file
3. Try to register as a new user

Expected Output

The registration to be completed successfully.

Anything else?

No response

[iamsyh]

Okay so I did some debugging and it seems like the issue only occurs when:

You comment out "email" from $validFields array in Config/Auth.php, and also have NothingPersonalValidator class added to the $passwordValidators array.

[kenjis]

At least you need to use Codeigniter v4.2.7 or later.
https://github.com/codeigniter4/shield/blob/develop/docs/install.md#requirements

[iamsyh]

The issue is that the email field is not included in the User entity object that is created when the email is removed from the $validFields array in the prepareValidFields function. Here's the code for that function:

file: src/Authentication/Passwords/ValidationRules.php

protected function prepareValidFields(): array
{
    $config   = config('Auth');
    $fields   = array_merge($config->validFields, $config->personalFields);
    $fields[] = 'password';

    return $fields;
}

The buildUserFromRequest function creates the User object using the $fields array returned by prepareValidFields. As a result, the email field is left out and is set to an empty value as the default value in the User class. Here's the code for that function:

file: src/Authentication/Passwords/ValidationRules.php

protected function buildUserFromRequest(): User
{
    $fields = $this->prepareValidFields();

    /** @var IncomingRequest $request */
    $request = service('request');

    $data = $request->getPost($fields);

    return new User($data);
}

Now, the NothingPersonalValidator requires an email to be present and not empty. And if it is not present then it tries to search for the user's email in the database which at this point is not there yet as the user is still in the process of registering.

file: src/Authentication/Passwords/NothingPersonalValidator.php

public function check(string $password, ?User $user = null): Result
    {
        $password = strtolower($password);

        if ($valid = $this->isNotPersonal($password, $user) === true) {
            $valid = $this->isNotSimilar($password, $user);
        }

        return new Result([
            'success'   => $valid,
            'reason'    => $this->error,
            'extraInfo' => $this->suggestion,
        ]);
}

file: src/Authentication/Passwords/NothingPersonalValidator.php

protected function isNotPersonal(string $password, ?User $user): bool
    {
        $userName = strtolower($user->username ?? '');
        $email    = strtolower($user->email);
        $valid    = true;
        // rest of the code of this function

$user->email points to this:

file: src/Entities/User.php

public function getEmail(): ?string
    {
        if ($this->email === null) {
            $this->email = $this->getEmailIdentity()->secret ?? null;
        }

        return $this->email;
    }

the rest you can trace in the log I posted in my op.

[iamsyh]

At least you need to use Codeigniter v4.2.7 or later. https://github.com/codeigniter4/shield/blob/develop/docs/install.md#requirements

sorry for the confusion, i am already using 4.3.2. i entered the CI version in my op. updated it now, thanks!

[kenjis]

Something like this?

--- a/src/Authentication/Passwords/ValidationRules.php
+++ b/src/Authentication/Passwords/ValidationRules.php
@@ -89,10 +89,9 @@ protected function buildUserFromData(array $data = []): User
      */
     protected function prepareValidFields(): array
     {
-        $config   = config('Auth');
-        $fields   = array_merge($config->validFields, $config->personalFields);
-        $fields[] = 'password';
+        $config = config('Auth');
+        $fields = array_merge($config->validFields, $config->personalFields, ['email', 'password']);
 
-        return $fields;
+        return array_unique($fields);
     }
 }

[iamsyh]

Something like this?

--- a/src/Authentication/Passwords/ValidationRules.php
+++ b/src/Authentication/Passwords/ValidationRules.php
@@ -89,10 +89,9 @@ protected function buildUserFromData(array $data = []): User
      */
     protected function prepareValidFields(): array
     {
-        $config   = config('Auth');
-        $fields   = array_merge($config->validFields, $config->personalFields);
-        $fields[] = 'password';
+        $config = config('Auth');
+        $fields = array_merge($config->validFields, $config->personalFields, ['email', 'password']);
 
-        return $fields;
+        return array_unique($fields);
     }
 }

yes i was thinking the same.. 👍🏻

[yuyake]

I have a question.
I want to register users using a username, not an email.
There is a similar issue as mentioned.
Can the source code mentioned as @iamsyh liamsyh solve this problem?
Do I need to wait for it to be included in the release?

[yuyake]

PHP Version
7.4.9

CodeIgniter4 Version
4.4.1

Shield Version
v1.0.0-beta.6

I recently started using Shield. I need a feature to log in using a username instead of an email. I tried the following method from this link: #323.

I also tried the method mentioned in the issue above. When registering, I encounter the following error:

"$user->id" is null. You should not use the incomplete User object.

I've tried various solutions, and it seems to be a problem with the code in these locations:

In vendor\codeigniter4\shield\src\Entities\User.php:

public function setEmail(?string $email): void
{
    $this->email = $email;
}

In vendor\codeigniter4\shield\src\Models\UserIdentityModel.php:

private function checkUserId(User $user): void
{
    if ($user->id === null) {
        throw new LogicException(
            '"$user->id" is null. You should not use the incomplete User object.'
        );
    }
}

It appears that the issue lies in these code sections. Specifically, it seems that the recent update to Shield has caused the login using a username instead of an email to not work at all.

Could someone please provide guidance on how to make the login using a username work in the latest version where it has been successful for someone else?

[datamweb]

@yuyake shield does not allow you to send an empty email field. This is because the email field must be unique. When you try to send an empty field, there will be a problem in the second registration because two null fields are registered in the table.

shield/src/Database/Migrations/2020-12-28-223112_create_auth_tables.php

Line 72 in 306616c

$this->forge->addUniqueKey(['type', 'secret']);

I suggest that if you don't want to receive email from the user, send some email incognito.

for e.g.
username-random_string@damin.com
see(https://codeigniter.com/user_guide/helpers/text_helper.html#id2)

Regarding login with username, $validFields , as its name suggests, allows login with fields, not allows registration with a specific field.

shield/src/Config/Auth.php

Lines 276 to 285 in 306616c

	/**
	* --------------------------------------------------------------------
	* Valid login fields
	* --------------------------------------------------------------------
	* Fields that are available to be used as credentials for login.
	*/
	public array $validFields = [
	'email',
	// 'username',
	];

The image below shows login with username.

Recording.2023-09-06.175417.mp4

[yuyake]

@yuyake shield does not allow you to send an empty email field. This is because the email field must be unique. When you try to send an empty field, there will be a problem in the second registration because two null fields are registered in the table.

shield/src/Database/Migrations/2020-12-28-223112_create_auth_tables.php

Line 72 in 306616c

$this->forge->addUniqueKey(['type', 'secret']);

I suggest that if you don't want to receive email from the user, send some email incognito.

for e.g. username-random_string@damin.com see(https://codeigniter.com/user_guide/helpers/text_helper.html#id2)

Regarding login with username, $validFields , as its name suggests, allows login with fields, not allows registration with a specific field.

shield/src/Config/Auth.php

Lines 276 to 285 in 306616c

	/**
	* --------------------------------------------------------------------
	* Valid login fields
	* --------------------------------------------------------------------
	* Fields that are available to be used as credentials for login.
	*/
	public array $validFields = [
	'email',
	// 'username',
	];

The image below shows login with username.

Recording.2023-09-06.175417.mp4

Thank you for your response.
My issue has been resolved.

For the login method that doesn't use email, I also assumed that it wouldn't involve using email during user registration. I will follow your suggested method to register with a random email.

Thank you once again!