[stable33] fix: Handle 2fa enforcement earlier

lib/private/User/Session.php

@@ -403,10 +403,8 @@ public function logClientIn($user,
 			return false;
 		}
 
-		if (!$isTokenPassword && $this->isTokenAuthEnforced()) {
-			throw new PasswordLoginForbiddenException();
-		}
-		if (!$isTokenPassword && $this->isTwoFactorEnforced($user)) {
+		if (!$isTokenPassword && ($this->isTokenAuthEnforced() || $this->isTwoFactorEnforced($user))) {
+			$this->handleLoginFailed($throttler, $currentDelay, $remoteAddress, $user, $password);
 			throw new PasswordLoginForbiddenException();
 		}
 
@@ -576,7 +574,8 @@ public function tryBasicAuthLogin(IRequest $request,
 				// If credentials were provided, they need to be valid, otherwise we do boom
 				throw new LoginException();
 			} catch (PasswordLoginForbiddenException $ex) {
-				// Nothing to do
+				// If credentials were provided, they need to be valid, otherwise we do boom
+				throw new LoginException(previous: $ex);
 			}
 		}
 		return false;

tests/lib/User/SessionTest.php

@@ -439,7 +439,7 @@ public function testLogClientInNoTokenPasswordWith2fa(): void {
 			->method('getRemoteAddress')
 			->willReturn('192.168.0.1');
 		$this->throttler
-			->expects($this->once())
+			->expects($this->exactly(2))
 			->method('sleepDelayOrThrowOnMax')
 			->with('192.168.0.1');
 		$this->throttler
@@ -448,6 +448,15 @@ public function testLogClientInNoTokenPasswordWith2fa(): void {
 			->with('192.168.0.1')
 			->willReturn(0);
 
+		$this->throttler
+			->expects($this->once())
+			->method('registerAttempt')
+			->with('login', '192.168.0.1', ['user' => 'john']);
+		$this->dispatcher
+			->expects($this->once())
+			->method('dispatchTyped')
+			->with(new LoginFailed('john', 'doe'));
+
 		$userSession->logClientIn('john', 'doe', $request, $this->throttler);
 	}
 
@@ -550,7 +559,7 @@ public function testLogClientInNoTokenPasswordNo2fa(): void {
 			->method('getRemoteAddress')
 			->willReturn('192.168.0.1');
 		$this->throttler
-			->expects($this->once())
+			->expects($this->exactly(2))
 			->method('sleepDelayOrThrowOnMax')
 			->with('192.168.0.1');
 		$this->throttler
@@ -559,6 +568,15 @@ public function testLogClientInNoTokenPasswordNo2fa(): void {
 			->with('192.168.0.1')
 			->willReturn(0);
 
+		$this->throttler
+			->expects($this->once())
+			->method('registerAttempt')
+			->with('login', '192.168.0.1', ['user' => 'john']);
+		$this->dispatcher
+			->expects($this->once())
+			->method('dispatchTyped')
+			->with(new LoginFailed('john', 'doe'));
+
 		$userSession->logClientIn('john', 'doe', $request, $this->throttler);
 	}