authenticate() on service including sequelize associated models brakes query

[cantoute]

Steps to reproduce

On a typescript setup using sequelize ORM
Populating context.params.sequelize on any service that uses hook all: [authenticate('jwt')] results in a broken query

I'm using a hook to implement $include[]=someAssociation that basically populates context.params.sequelize
then using association on requests with authentication

• if request didn't include users it adds users table into the query linking whatever (out of commented query below ON "users"."id" = "parents->tags_tags"."tagId")
• or tries users.userId (of course doesn't exist) when $include[]=user ex: accounts.belongsTo(users, {as: 'user'})

as a workaround I proxy the authenticate('jwt') with a hook that hides context.params.sequelize.include from authenticate()

hooks/fix-authentication-sequelize.ts

// Use this hook to manipulate incoming or outgoing data.
// For more information on hooks see: http://docs.feathersjs.com/api/hooks.html
import { Hook, HookContext } from '@feathersjs/feathers';
import * as authentication from '@feathersjs/authentication';
import { AuthenticateHookSettings } from '@feathersjs/authentication/lib/hooks/authenticate';

const { authenticate } = authentication.hooks;

/*
When calling authenticate (strategy 'jwt')
and that context.params has a sequelize include 
in my case a service (tags) including a model alias 'parents' of type belongsToMany(tags, through: tagsTags)
tags and tagsTags have in the model description (but wasn't included in the current call) a relations belongsTo(users, as: author)

then an error would emerge out of users service
error: 'invalid reference to FROM-clause entry for table "tags"'
error: error app.service('users').get()

here part of the SQL
FROM
  "users" AS "users"
  LEFT OUTER JOIN (
    "tags_tags" AS "parents->tags_tags"
    INNER JOIN "tags" AS "parents" ON "parents"."id" = "parents->tags_tags"."parentTagId"
  ) ON "users"."id" = "parents->tags_tags"."tagId"
  AND "parents"."id" != "tags"."id"
  LEFT OUTER JOIN "media" AS "parents->featuredImage" ON "parents"."featuredMediumId" = "parents->featuredImage"."id"
WHERE
  ("users"."id" = '1');

So on querying users it would try to link to the models included in the request to 'tags' service

As a workaround I 'proxied' the authenticate() hook with this one, it basically deletes context.params.sequelize.include 

import authenticate from '../../hooks/fix-authenticate-sequelize-include';

that I then use as I would normally use authenticate('jwt')

*/

export default (originalSettings: string | AuthenticateHookSettings, ...originalStrategies: string[]): Hook => {
  return async (context: HookContext) => {
    if (context.params && context.params.sequelize && context.params.sequelize.include) {
      const { sequelize } = context.params;
      const { include } = sequelize;

      let contextWithoutInclude = context;
      delete contextWithoutInclude.params.sequelize.include;

      let authContext = await authenticate(originalSettings, ...originalStrategies)(contextWithoutInclude);
      authContext.params.sequelize.include = include;

      return authContext;
    } else {
      return authenticate(originalSettings, ...originalStrategies)(context);
    }
  };
};

not sure it's realy relevant, but putting it too
hooks/include-associated-models.ts

import { Hook, HookContext } from '@feathersjs/feathers';
import logger from '../logger';
import { merge } from 'lodash';

const hydrate = require('feathers-sequelize/hooks/hydrate');

// inspired by https://stackoverflow.com/questions/48602085/using-feathers-client-and-sequelize-many-to-many-relation

export default (options = {}): any => {
  return async function (this: any, context: HookContext) {
    switch (context.type) {
      case 'before':
        if (context.params && context.params.query) {
          if ('$include' in context.params.query) {
            const { $include, ...query } = context.params.query;

            // Update the query to not include `$include`
            context.params.query = query;

            context.params.sequelize = context.params.sequelize || {};

            let include: any = [];

            // see https://jsperf.com/array-coerce
            (Array.isArray($include) ? $include : [$include]).forEach(
              (name: string) => {
                if (name in context.service.Model.associations) {
                  include.push({
                    association: context.service.Model.associations[name],
                    as: name,
                  });
                } else {
                  logger.warn(
                    `Requested association '${name}' of model '%s' doesn't exist. Available associations are: %O`,
                    context.service.Model.name,
                    context.service.Model.associations
                  );
                }
              }
            );

            if (include) {
              merge(context.params.sequelize, {
                include,
                raw: false,
              });
            }
          }

          if ('$scope' in context.params.query) {
            const { $scope, ...query } = context.params.query;
            // Update the query to not include `$scope`
            context.params.query = query;

            context.params.sequelize = context.params.sequelize || {};

            merge(context.params.sequelize, {
              scope: $scope,
            });
          }

          if ('$raw' in context.params.query) {
            const { $raw, ...query } = context.params.query;

            // Update the query to not include `$raw`
            context.params.query = query;

            context.params.sequelize = context.params.sequelize || {};
            Object.assign(context.params.sequelize, { raw: !!$raw });
          }
        }

        break;

      case 'after':
        // I still don't understand why we have to do this as I didn't see any difference using it (yet)
        // they say so here:
        // https://github.com/feathersjs-ecosystem/feathers-sequelize#working-with-sequelize-model-instances

        if (
          context.params &&
          context.params.sequelize &&
          context.params.sequelize.include &&
          !context.params.sequelize.raw
        ) {
          hydrate().call(this, context);
        }
        break;
    }

    return context;
  };
};

Expected behavior

authentication not to change/look at context.params.sequelize.include

Actual behavior

resulting query generated by sequelize gets all broken

System configuration

Module versions
"@feathersjs/authentication": "^4.5.8",
"@feathersjs/authentication-local": "^4.5.8",

NodeJS version:
10..12

Operating System:
OSX / Linux