[6801318d8d]

• Resolves: Make failed login events (AnyLoginFailedEvent, TwoFactorProviderChallengeFailed) available to webhook_listeners #65492

Summary

webhook_listeners only accepts events that implement IWebhookCompatibleEvent. The two events that describe failed logins did not, so registering a webhook for them was rejected with "… is not an event class compatible with webhooks", and an admin could not be notified (ntfy, Gotify, a chat webhook…) when someone fails to log in.

This makes both events webhook compatible, the same way #60305 did for UserFirstTimeLoggedInEvent:

• OCP\Authentication\Events\AnyLoginFailedEvent: the payload contains only the login name. The attempted password (getPassword()) is never serialized, and a unit test checks that.
• OCP\Authentication\TwoFactorAuth\TwoFactorProviderChallengeFailed: the payload contains the user (uid, displayName, via JsonSerializer::serializeUser()) and the provider (id, displayName).

Webhook body for a failed login (the top-level user is null because there is no session):

{"event":{"loginName":"alice","class":"OCP\\Authentication\\Events\\AnyLoginFailedEvent"},"user":null,"time":1793024764}

Notes:

• Failed logins can be triggered by unauthenticated clients. Brute-force protection throttles them, but every failure that matches a registered webhook queues a WebhookCall job. Nothing changes unless an admin registers a webhook for these events.
• The remote address is not part of the event, so it is not in the payload.

How it was tested

• New unit tests: tests/lib/Authentication/Events/AnyLoginFailedEventTest.php and tests/lib/Authentication/TwoFactorAuth/TwoFactorProviderChallengeFailedTest.php.
• Existing tests that use these events or the webhook app pass: tests/lib/Authentication/TwoFactorAuth/ManagerTest.php, apps/admin_audit/tests/Listener/AuthEventListenerTest.php, apps/webhook_listeners/tests (PHP 8.5, SQLite).
• End to end on a fresh instance of this branch (SQLite, PHP built-in server): POST /ocs/v2.php/apps/webhook_listeners/api/v1/webhooks accepted both events, then a failed WebDAV login (401) queued a WebhookCall job with the body above.
• php-cs-fixer with the Nextcloud coding standard reports no changes.
• Not done: psalm, and an end-to-end run of a failed second factor (only the unit test covers it).

TODO

• Add the two events to the event list in the admin manual (admin_manual/webhook_listeners/index.rst in nextcloud/documentation)

Checklist

• Code is properly formatted
• Sign-off message is added to all commits
• Tests (unit, integration, api and/or acceptance) are included
• Screenshots before/after for front-end changes
• Documentation (manuals or wiki) has been updated or is not required
• Backports requested where applicable (ex: critical bugfixes)
• Labels added where applicable (ex: bug/enhancement, 3. to review, feature component)
• Milestone added for target branch/version (ex: 32.x for stable32)

AI (if applicable)

• The content of this PR was partly or fully generated using AI