Bug with shared collection

mmmm I don't really see it as its individual to the account

$collection = 'rest_password';
$tempstore = $service->get($collection, $account->id()); // AKA individual to user
$tempstore->set('temp_pass', $random_string);


The above kinda says hay SET user X's temp password something random in ... then later after the user changes (before it expires of corse) it then it is deleted or unsets..
can you please explain or point out where it is using a shared storage ? yes tempstorage but temp can be multiple and unique !?

Your welcome to create a patch if you like.

I have also faced this issue.

let's say User1 request the password reset, and before User1 uses the temp password, User2 also request the password. Now If user1 uses the temp password, the response is "No valid temp password request."

            $service = \Drupal::service('tempstore.shared');
            $collection = 'rest_password';
            $tempstore = $service->get($collection, $uid);
            $temp_pass_from_storage = $tempstore->getIfOwner('temp_pass');

This is returning null.

$tempstore = $service->get($collection, $account->id());
this just set's the owner of the key. So when User2 create password request, the owner of key "temp_pass" changed to User2 and also the value changed.

I have used user id with key "temp_pass" to make it unique for the account.
I hope this works.

Why we can't use service tempstore.private instead tempstore.shared?

Ok both issues are not in the 1.7 release
I have merged patch in # 6 , thanks again @anmolgoyal74.

also qzmenko please don't hijack threads :) but i have refactored the code to use the tempstore.private

so ... closing this.

what workflow did you use to get that ?
any other modules in use such as email reg ?
Note changing this to bug with 8.1.7 release

i did see a small issue where the temp_pass is never being deleted so 8.1.8 will include the following fix

// Delete temp password.
- $tempstore->delete('temp_pass');
+ // Delete temp password because next time it will be not valid.
+ $tempstore->delete('temp_pass_' . $uid);

please use https://www.drupal.org/files/issues/2021-01-05/8.1.7_small_delete_issue.... untill 8.1.8 release

ok ill try to test with the same modules ect

fyi -> the patch wont work though in your case:
it just removes the temp pass, so the next call will result in the error message
as you can see...
// Delete temp password.
- $tempstore->delete('temp_pass'); <--- that does not delete anything ever :(
+ // Delete temp password because next time it will be not valid.
+ $tempstore->delete('temp_pass_' . $uid); < --- this does

ok looking at your patch please note that this 8.1.7 release now uses
$service = \Drupal::service('tempstore.private'); not shared. so there may be conflict ? as you use the shared service ?

eg (https://www.drupal.org/project/rest_register_verify_email/issues/3167613)
- $service = \Drupal::service('tempstore.shared');
+ $service = \Drupal::service('tempstore.private');
$collection = 'rest_register_verify_email';
$tempstore = $service->get($collection, $uid);
- $temp_token = $tempstore->getIfOwner('temp_token_' . $uid);
+ $temp_token = $tempstore->get('temp_token_' . $uid);

Ill try it with you patch what Drupal core are you using (if i may ask) because I am just testing with 8.9.1

I had the same issue, actually everything worked fine if I tested via the postman but it didn't work from the react app, so as a temprorary solution downgraded to 8.16 and applied patch.

Hi
tempstore.private cannot be used here since it is user-specific. In our case, the requests come from an anonymous user.
IMHO, tempstore.shared is the only solution here.

glynster is this now working for you with release 8.1.8 ?
- sorry been flat out with work and home life