feat(webhook_listeners): make failed login events webhook compatible

lib/public/Authentication/Events/AnyLoginFailedEvent.php

@@ -10,13 +10,15 @@
 namespace OCP\Authentication\Events;
 
 use OCP\EventDispatcher\Event;
+use OCP\EventDispatcher\IWebhookCompatibleEvent;
 
 /**
  * Emitted when the authentication fails
  *
  * @since 26.0.0
+ * @since 36.0.0 Implements IWebhookCompatibleEvent
  */
-class AnyLoginFailedEvent extends Event {
+class AnyLoginFailedEvent extends Event implements IWebhookCompatibleEvent {
 	private string $loginName;
 	private ?string $password;
 
@@ -51,4 +53,16 @@ public function getLoginName(): string {
 	public function getPassword(): ?string {
 		return $this->password;
 	}
+
+	/**
+	 * The attempted password is never part of the payload.
+	 *
+	 * @since 36.0.0
+	 */
+	#[\Override]
+	public function getWebhookSerializable(): array {
+		return [
+			'loginName' => $this->loginName,
+		];
+	}
 }

lib/public/Authentication/TwoFactorAuth/TwoFactorProviderChallengeFailed.php

@@ -10,12 +10,15 @@
 namespace OCP\Authentication\TwoFactorAuth;
 
 use OCP\EventDispatcher\Event;
+use OCP\EventDispatcher\IWebhookCompatibleEvent;
+use OCP\EventDispatcher\JsonSerializer;
 use OCP\IUser;
 
 /**
  * @since 28.0.0
+ * @since 36.0.0 Implements IWebhookCompatibleEvent
  */
-class TwoFactorProviderChallengeFailed extends Event {
+class TwoFactorProviderChallengeFailed extends Event implements IWebhookCompatibleEvent {
 	/**
 	 * @since 28.0.0
 	 */
@@ -39,4 +42,18 @@ public function getUser(): IUser {
 	public function getProvider(): IProvider {
 		return $this->provider;
 	}
+
+	/**
+	 * @since 36.0.0
+	 */
+	#[\Override]
+	public function getWebhookSerializable(): array {
+		return [
+			'user' => JsonSerializer::serializeUser($this->user),
+			'provider' => [
+				'id' => $this->provider->getId(),
+				'displayName' => $this->provider->getDisplayName(),
+			],
+		];
+	}
 }

tests/lib/Authentication/Events/AnyLoginFailedEventTest.php

@@ -0,0 +1,29 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace Test\Authentication\Events;
+
+use OCP\Authentication\Events\AnyLoginFailedEvent;
+use OCP\EventDispatcher\IWebhookCompatibleEvent;
+use Test\TestCase;
+
+class AnyLoginFailedEventTest extends TestCase {
+	public function testWebhookSerializable(): void {
+		$event = new AnyLoginFailedEvent('alice', 'secret-password');
+
+		$this->assertInstanceOf(IWebhookCompatibleEvent::class, $event);
+		$this->assertSame(['loginName' => 'alice'], $event->getWebhookSerializable());
+	}
+
+	public function testWebhookSerializableNeverContainsPassword(): void {
+		$event = new AnyLoginFailedEvent('alice', 'secret-password');
+
+		$this->assertStringNotContainsString('secret-password', json_encode($event->getWebhookSerializable(), JSON_THROW_ON_ERROR));
+	}
+}

tests/lib/Authentication/TwoFactorAuth/TwoFactorProviderChallengeFailedTest.php

@@ -0,0 +1,41 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace Test\Authentication\TwoFactorAuth;
+
+use OCP\Authentication\TwoFactorAuth\IProvider;
+use OCP\Authentication\TwoFactorAuth\TwoFactorProviderChallengeFailed;
+use OCP\EventDispatcher\IWebhookCompatibleEvent;
+use OCP\IUser;
+use Test\TestCase;
+
+class TwoFactorProviderChallengeFailedTest extends TestCase {
+	public function testWebhookSerializable(): void {
+		$user = $this->createMock(IUser::class);
+		$user->method('getUID')->willReturn('alice');
+		$user->method('getDisplayName')->willReturn('Alice');
+		$provider = $this->createMock(IProvider::class);
+		$provider->method('getId')->willReturn('totp');
+		$provider->method('getDisplayName')->willReturn('TOTP (Authenticator app)');
+
+		$event = new TwoFactorProviderChallengeFailed($user, $provider);
+
+		$this->assertInstanceOf(IWebhookCompatibleEvent::class, $event);
+		$this->assertSame([
+			'user' => [
+				'uid' => 'alice',
+				'displayName' => 'Alice',
+			],
+			'provider' => [
+				'id' => 'totp',
+				'displayName' => 'TOTP (Authenticator app)',
+			],
+		], $event->getWebhookSerializable());
+	}
+}