fix: add missing assertion $user->id !== null

Author: kenjis

src/Models/UserIdentityModel.php

@@ -59,6 +59,8 @@ public function create($data): void
      */
     public function createEmailIdentity(User $user, array $credentials): void
     {
+        assert($user->id !== null, '"$user->id" must not be null.');
+
         /** @var Passwords $passwords */
         $passwords = service('passwords');
 
@@ -85,7 +87,7 @@ public function createCodeIdentity(
         array $data,
         callable $codeGenerator
     ): string {
-        assert($user->id !== null);
+        assert($user->id !== null, '"$user->id" must not be null.');
 
         helper('text');
 
@@ -120,6 +122,8 @@ public function createCodeIdentity(
      */
     public function generateAccessToken(User $user, string $name, array $scopes = ['*']): AccessToken
     {
+        assert($user->id !== null, '"$user->id" must not be null.');
+
         helper('text');
 
         $return = $this->insert([
@@ -153,6 +157,8 @@ public function getAccessTokenByRawToken(string $rawToken): ?AccessToken
 
     public function getAccessToken(User $user, string $rawToken): ?AccessToken
     {
+        assert($user->id !== null, '"$user->id" must not be null.');
+
         return $this->where('user_id', $user->id)
             ->where('type', AccessTokens::ID_TYPE_ACCESS_TOKEN)
             ->where('secret', hash('sha256', $rawToken))
@@ -167,6 +173,8 @@ public function getAccessToken(User $user, string $rawToken): ?AccessToken
      */
     public function getAccessTokenById($id, User $user): ?AccessToken
     {
+        assert($user->id !== null, '"$user->id" must not be null.');
+
         return $this->where('user_id', $user->id)
             ->where('type', AccessTokens::ID_TYPE_ACCESS_TOKEN)
             ->where('id', $id)
@@ -179,6 +187,8 @@ public function getAccessTokenById($id, User $user): ?AccessToken
      */
     public function getAllAccessTokens(User $user): array
     {
+        assert($user->id !== null, '"$user->id" must not be null.');
+
         return $this
             ->where('user_id', $user->id)
             ->where('type', AccessTokens::ID_TYPE_ACCESS_TOKEN)
@@ -208,6 +218,8 @@ public function getIdentityBySecret(string $type, ?string $secret): ?UserIdentit
      */
     public function getIdentities(User $user): array
     {
+        assert($user->id !== null, '"$user->id" must not be null.');
+
         return $this->where('user_id', $user->id)->orderBy($this->primaryKey)->findAll();
     }
 
@@ -226,6 +238,8 @@ public function getIdentitiesByUserIds(array $userIds): array
      */
     public function getIdentityByType(User $user, string $type): ?UserIdentity
     {
+        assert($user->id !== null, '"$user->id" must not be null.');
+
         return $this->where('user_id', $user->id)
             ->where('type', $type)
             ->orderBy($this->primaryKey)
@@ -241,6 +255,8 @@ public function getIdentityByType(User $user, string $type): ?UserIdentity
      */
     public function getIdentitiesByTypes(User $user, array $types): array
     {
+        assert($user->id !== null, '"$user->id" must not be null.');
+
         if ($types === []) {
             return [];
         }
@@ -265,6 +281,8 @@ public function touchIdentity(UserIdentity $identity): void
 
     public function deleteIdentitiesByType(User $user, string $type): void
     {
+        assert($user->id !== null, '"$user->id" must not be null.');
+
         $return = $this->where('user_id', $user->id)
             ->where('type', $type)
             ->delete();
@@ -277,6 +295,8 @@ public function deleteIdentitiesByType(User $user, string $type): void
      */
     public function revokeAccessToken(User $user, string $rawToken): void
     {
+        assert($user->id !== null, '"$user->id" must not be null.');
+
         $return = $this->where('user_id', $user->id)
             ->where('type', AccessTokens::ID_TYPE_ACCESS_TOKEN)
             ->where('secret', hash('sha256', $rawToken))
@@ -290,6 +310,8 @@ public function revokeAccessToken(User $user, string $rawToken): void
      */
     public function revokeAllAccessTokens(User $user): void
     {
+        assert($user->id !== null, '"$user->id" must not be null.');
+
         $return = $this->where('user_id', $user->id)
             ->where('type', AccessTokens::ID_TYPE_ACCESS_TOKEN)
             ->delete();

src/Models/UserModel.php

@@ -303,6 +303,9 @@ protected function saveEmailIdentity(array $data): array
             /** @var User $user */
             $user = $this->find($this->db->insertID());
 
+            // If you get identity (email/password), the User object must have the id.
+            $this->tempUser->id = $user->id;
+
             $user->email         = $this->tempUser->email ?? '';
             $user->password      = $this->tempUser->password ?? '';
             $user->password_hash = $this->tempUser->password_hash ?? '';