fix: Handle 2fa enforcement earlier

Signed-off-by: Joas Schilling <coding@schilljs.com>

Author: nickvergessen

lib/private/User/Session.php

@@ -403,10 +403,8 @@ public function logClientIn($user,
 			return false;
 		}
 
-		if (!$isTokenPassword && $this->isTokenAuthEnforced()) {
-			throw new PasswordLoginForbiddenException();
-		}
-		if (!$isTokenPassword && $this->isTwoFactorEnforced($user)) {
+		if (!$isTokenPassword && ($this->isTokenAuthEnforced() || $this->isTwoFactorEnforced($user))) {
+			$this->handleLoginFailed($throttler, $currentDelay, $remoteAddress, $user, $password);
 			throw new PasswordLoginForbiddenException();
 		}
 
@@ -587,7 +585,8 @@ public function tryBasicAuthLogin(IRequest $request,
 				// If credentials were provided, they need to be valid, otherwise we do boom
 				throw new LoginException();
 			} catch (PasswordLoginForbiddenException $ex) {
-				// Nothing to do
+				// If credentials were provided, they need to be valid, otherwise we do boom
+				throw new LoginException(previous: $ex);
 			}
 		}
 		return false;

tests/lib/User/SessionTest.php

@@ -439,7 +439,7 @@ public function testLogClientInNoTokenPasswordWith2fa(): void {
 			->method('getRemoteAddress')
 			->willReturn('192.168.0.1');
 		$this->throttler
-			->expects($this->once())
+			->expects($this->exactly(2))
 			->method('sleepDelayOrThrowOnMax')
 			->with('192.168.0.1');
 		$this->throttler
@@ -551,7 +551,7 @@ public function testLogClientInNoTokenPasswordNo2fa(): void {
 			->method('getRemoteAddress')
 			->willReturn('192.168.0.1');
 		$this->throttler
-			->expects($this->once())
+			->expects($this->exactly(2))
 			->method('sleepDelayOrThrowOnMax')
 			->with('192.168.0.1');
 		$this->throttler