[8.x] Protect against ambiguous columns

[BenWalters]

Resolving #43274

When applying a global scope to a User model that joins a secondary table, which also has an ID field, the retrieveById and retrieveByToken functions of Illuminate\Auth\EloquentUserProvider do not qualify the identifier field name in the where clause which. This subsequently causes a "Integrity constraint violation: 1052 Column 'id' in where clause is ambiguous" error.

Wrapping $model->getAuthIdentifierName() in $model->qualifyColumn() on both methods protects against this.
This is a non-breaking change and is in-line with other abstract queries/builders. Tests updated accordingly.

Example global scope:

class ActiveUsersScope extends AbstractGlobalScope implements Scope
{
    /**
     * Apply the scope to a given Eloquent query builder.
     *
     * @param Builder $builder
     * @param Model $model
     * @return void
     */
    public function apply(Builder $builder, Model $model): void
    {
        $userOrganizationModel = new UserOrganization();

        $builder
            ->join(
                $userOrganizationModel->getTable(),
                $userOrganizationModel->qualifyColumn('user_id'),
                '=',
                $model->qualifyColumn('id')
            )
            ->where($userOrganizationModel->qualifyColumn('status'), UserStatus::ACTIVE);
    }
}

[driesvints]

@BenWalters please add a thorough explanation to your main PR description (see the PR template) so Taylor knows what this is about. Thanks.

[BenWalters]

@driesvints updated! Let me know if anything else is needed.

[driesvints]

@BenWalters maybe also share an example of the global scope

[BenWalters]

@driesvints it's a WIP but I've added an example.

[driesvints]

This looks like a breaking change so we're reverting this: #43353

[BenWalters]

@driesvints no problem, I would however say that this is 'breaking' because of a 3rd party packages bad implementation. The Mongo DB package does not prefix fields with table names. They have only overridden some of the qualify column methods that are implemented on the abstract Model class that Laravel Framework provides.

[BenWalters]

@driesvints sorry, I'd not seen the octane issue also. I cannot comment on that one.

[BenWalters]

Having just looked at it though it's also because MongoDB is being used.