From 675a13be6ccae49b4908b5c2a7c770bd7fd9038a Mon Sep 17 00:00:00 2001
From: Damien Grossfeld <damien.grossfeld@gmail.com>
Date: Thu, 7 May 2026 10:54:49 +0200
Subject: [PATCH] fix: type-hint finders with Cake\ORM\Query\SelectQuery for
 Cake 5

Cake\ORM\Query is a class_alias of Cake\ORM\Query\SelectQuery in
Cake 5, so the legacy import worked at autoload time but PHP's parameter
type checks at the Cake\ORM\BehaviorRegistry::callFinder() entry point
report the canonical class name (SelectQuery) and reject the alias name
(Query) used in the behavior signatures:

  TypeError: CakeDC\\Users\\Model\\Behavior\\OneTimeLoginLinkBehavior::findByOneTimeToken():
  Argument #1 ($query) must be of type Cake\\ORM\\Query,
  Cake\\ORM\\Query\\SelectQuery given

This blows up on every request that goes through the OneTimeToken
authenticator (cakedc/auth) because the authenticator calls
$users->loginWithToken($token) on every authenticated request, which
internally fires find('byOneTimeToken') and dispatches to the behavior
finder.

Switch the import to Cake\\ORM\\Query\\SelectQuery and update the
two finder signatures + their docblocks to match. Keeps behaviour
identical, fixes the TypeError.
---
 src/Model/Behavior/OneTimeLoginLinkBehavior.php | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/src/Model/Behavior/OneTimeLoginLinkBehavior.php b/src/Model/Behavior/OneTimeLoginLinkBehavior.php
index e9186693..8d347531 100644
--- a/src/Model/Behavior/OneTimeLoginLinkBehavior.php
+++ b/src/Model/Behavior/OneTimeLoginLinkBehavior.php
@@ -8,7 +8,7 @@
 use Cake\Datasource\Exception\RecordNotFoundException;
 use Cake\I18n\DateTime;
 use Cake\ORM\Behavior;
-use Cake\ORM\Query;
+use Cake\ORM\Query\SelectQuery;
 use OutOfBoundsException;
 
 /**
@@ -103,11 +103,11 @@ public function requestTokenSend(string $username): void
     /**
      * Find by username or email.
      *
-     * @param \Cake\ORM\Query $query The query builder.
+     * @param \Cake\ORM\Query\SelectQuery $query The query builder.
      * @param string|null $username Username or email.
-     * @return \Cake\ORM\Query
+     * @return \Cake\ORM\Query\SelectQuery
      */
-    public function findByUsernameOrEmail(Query $query, ?string $username = null): Query
+    public function findByUsernameOrEmail(SelectQuery $query, ?string $username = null): SelectQuery
     {
         if (empty($username)) {
             throw new OutOfBoundsException('Missing username');
@@ -124,11 +124,11 @@ public function findByUsernameOrEmail(Query $query, ?string $username = null): Q
     /**
      * Find by token
      *
-     * @param \Cake\ORM\Query $query
-     * @param string|null $token
-     * @return \Cake\ORM\Query
+     * @param \Cake\ORM\Query\SelectQuery $query The query builder.
+     * @param string|null $token Login token.
+     * @return \Cake\ORM\Query\SelectQuery
      */
-    public function findByOneTimeToken(Query $query, ?string $token = null): Query
+    public function findByOneTimeToken(SelectQuery $query, ?string $token = null): SelectQuery
     {
         if (empty($token)) {
             throw new OutOfBoundsException('Missing token');