[abdulmajidcse]

Follow-ups to #400. Docs: doppar/docs#125.

Changes

Fix: password recorded wrongly by withoutHook()->update()

When hooks are off, Authable::update() recorded the raw password value passed in as the device's pending password. Model::update() stores the value through setAttribute(), which trims it (sanitize()) and applies any #[Cast] set-cast. If the two differed, the pending fingerprint didn't match the saved hash, and AuthenticateSession signed out the device that had just changed its own password.

The value is now normalised the same way setAttribute() does before it is recorded.

session:table --uuid

The generated migration used a big-integer user_id, which breaks session writes for apps with UUID or ULID user keys on MySQL and PostgreSQL. php pool session:table --uuid now generates string('user_id', 36). The default is unchanged.

Docblock

The Authenticate::sessions() docblock said "other devices", but the list includes the current one (is_current).

Tests

• New: test_a_password_updated_without_hooks_is_recorded_as_the_model_stores_it. It fails without the fix.
• New: session:table default and --uuid column tests.
• DatabaseStoreTest::migrate() now fills in the new {{ user_id }} placeholder.
• Full suite on PHP 8.5 (SQLite): 6160 tests pass. The MySQL, PostgreSQL and Redis tests were skipped locally because those services weren't available.

[techmahedy]

Please revert the changelog, this will auto update after releasing, update the docs carefully

[abdulmajidcse]

@techmahedy Thanks for the review. Both points are addressed:

• CHANGELOG: reverted in 72a71af. The PR no longer touches CHANGELOG.md.
• Docs: updated in docs(session): document session:table --uuid and the APP_KEY effect on AuthenticateSession docs#125:
  • session.md, Database Driver: the UUID/ULID note now points to php pool session:table --uuid instead of editing the migration by hand.
  • session.md, Console Commands: mentions the --uuid option.
  • authentication.md, Checking Sessions on Every Request: notes that changing APP_KEY signs every session out on routes that use AuthenticateSession.

The rest was already covered in the docs (old sessions signed out once, the default-actor limit, sessions() including the current device), so I left it as is.

Could you take another look?

[techmahedy]

Thanks for addressing the issues. Looks good now