From a85bb176d6628e6241b5d5ced9f48838a64ba982 Mon Sep 17 00:00:00 2001
From: "Fabian @ Blax Software" <fabian@blax.at>
Date: Fri, 25 Sep 2026 10:22:15 +0200
Subject: [PATCH] fix(ws-auth): only email and password are login credentials

auth.login passed its whole validated payload to Auth::attempt(). When the
client sent a stale bearer `token` next to email/password (an expired
session, or a token another app left on the same origin), the provider
turned it into `where token = ...` on users. That threw "Unknown column
'token'" and every correct password came back as invalid credentials.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 src/Websocket/Controllers/AuthController.php | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/src/Websocket/Controllers/AuthController.php b/src/Websocket/Controllers/AuthController.php
index 0ce8914..12f1f9d 100644
--- a/src/Websocket/Controllers/AuthController.php
+++ b/src/Websocket/Controllers/AuthController.php
@@ -57,8 +57,13 @@ class AuthController extends \BlaxSoftware\LaravelWebSockets\Websocket\Controlle
             }
         }
 
-        // Path 2: email + password → new token.
-        if (! Auth::check() && isset($data['email'], $data['password']) && Auth::attempt($data)) {
+        // Path 2: email + password → new token. Only these two keys are credentials:
+        // a stale `token` riding along would become `where token = …` on users.
+        if (
+            ! Auth::check()
+            && isset($data['email'], $data['password'])
+            && Auth::attempt(['email' => $data['email'], 'password' => $data['password']])
+        ) {
             $user = Auth::user();
 
             if (method_exists($user, 'createToken')) {